Computer per OU average should be retrievable
AD-COMP-08InfoActive DirectoryComputers
Part of Active Directory · Active Directory · Computers · All checks
Invoke-Maester -TestId AD-COMP-08Overview
Section titled “Overview”Understanding the distribution density of computers across OUs helps identify:
- Overloaded OUs: OUs with too many computers may indicate poor structure or policy bottlenecks
- Underutilized OUs: Many OUs with very few computers may indicate unnecessary complexity
- Policy application issues: Uneven distribution can lead to inconsistent security policy application
- Administrative burden: Poor structure increases management overhead
The average, minimum, and maximum computers per OU provide metrics for assessing organizational efficiency.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Aim for a balanced OU structure that:
- Supports your Group Policy design (each OU should have a clear policy purpose)
- Enables delegated administration without excessive granularity
- Can be easily understood and navigated by administrators
- Investigate OUs with unusually high computer counts
- Consider consolidating OUs with very few computers if they serve similar purposes
- Document the OU design rationale for future administrators
How the Test Works
Section titled “How the Test Works”This test groups all enabled computers by their parent container and calculates:
- Average computers per OU
- Minimum computers in any OU
- Maximum computers in any OU
- Distribution across the top containers
Related Tests
Section titled “Related Tests”Test-MtAdComputerOUCount- Counts the total number of OUs with computersTest-MtAdComputerInDefaultContainer- Identifies potential OU structure gaps
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-COMP-08 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Computers |
| Area | Infrastructure hardening |
| Resource type | OrganizationalUnit |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdComputerPerOUAverage |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/computer/Test.AD-COMP-08.ps1 - Documentation:
tests/ad/computer/Test.AD-COMP-08.md