Non-Global Catalog DC count should be retrievable
AD-DCD-04InfoActive DirectoryDomain controllers
Part of Active Directory · Active Directory · Domain controllers · All checks
Invoke-Maester -TestId AD-DCD-04Overview
Section titled “Overview”Global Catalogs (GCs) maintain a partial replica of all objects in the Active Directory forest, enabling:
- Forest-wide searches: Users can search for objects across all domains in the forest
- Universal group membership caching: Required for authentication when universal groups are used
- Efficient authentication: Users can be authenticated even when their home domain’s DC is unavailable
In a single-domain environment, all domain controllers should be Global Catalogs for optimal performance and redundancy. There’s no downside to making all DCs GCs when there’s only one domain.
In a multi-domain forest, proper Global Catalog placement is critical:
- Each site should have at least one GC for optimal authentication performance
- Too few GCs can cause authentication delays and failures
- Too many GCs can increase replication traffic
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Single-domain forests: Configure all DCs as Global Catalogs
- Multi-domain forests: Ensure each site has at least one GC, preferably in the same site as the users
- Monitor GC health: Regularly verify GCs are functioning properly
- Plan for GC failure: Ensure redundant GC coverage for business-critical sites
- Universal group considerations: If not using universal groups, GC requirements may be reduced, but GCs still provide benefits for directory searches
How the Test Works
Section titled “How the Test Works”This test retrieves all domain controllers and identifies which are configured as Global Catalogs. The test reports:
- Total number of domain controllers
- Number of DCs configured as Global Catalogs
- Number of DCs not configured as Global Catalogs
- Names of non-GC DCs (if any exist)
- Forest domain count to provide context for the configuration
The test provides different guidance based on whether the forest is single-domain or multi-domain.
Related Tests
Section titled “Related Tests”Test-MtAdDcReadOnlyCount- Analyzes RODC deploymentTest-MtAdDcSiteCoverageCount- Analyzes DC distribution across sitesTest-MtAdForestDomainCount- Determines the number of domains in the forest
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DCD-04 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain controllers |
| Area | Infrastructure hardening |
| Resource type | DomainController |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdDcNonGlobalCatalogCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty, ActiveDirectory:Ldap:crossRef:ReadProperty |