Computer OU count should be retrievable
AD-COMP-07InfoActive DirectoryComputers
Part of Active Directory · Active Directory · Computers · All checks
Invoke-Maester -TestId AD-COMP-07Overview
Section titled “Overview”The organizational structure of computer accounts reflects your Active Directory management maturity:
- Management efficiency: Well-structured OUs enable targeted Group Policy and administrative delegation
- Security boundaries: OUs can represent security zones with different policy requirements
- Operational clarity: Clear structure makes troubleshooting and auditing easier
- Compliance alignment: Many frameworks require logical organization of directory objects
A single flat structure (few OUs) or excessive fragmentation (many OUs with few computers) both indicate potential management challenges.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Design an OU structure that supports:
- Geographic distribution (if applicable)
- Functional separation (workstations, servers, administrative tiers)
- Security policy boundaries
- Avoid placing computers directly in the domain root
- Ensure the structure supports your Group Policy design
- Regularly review and consolidate underutilized OUs
How the Test Works
Section titled “How the Test Works”This test analyzes all enabled computer accounts and counts the distinct organizational units (containers) where computers are located. It provides insight into the breadth of your OU structure.
Related Tests
Section titled “Related Tests”Test-MtAdComputerPerOUAverage- Calculates the average computers per OUTest-MtAdComputerInDefaultContainer- Identifies computers in the unmanaged default container
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-COMP-07 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Computers |
| Area | Infrastructure hardening |
| Resource type | OrganizationalUnit |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdComputerOUCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/computer/Test.AD-COMP-07.ps1 - Documentation:
tests/ad/computer/Test.AD-COMP-07.md