Domain controller count should be retrievable

AD-DOM-03InfoActive DirectoryDomain controllers

Part of Active Directory · Active Directory · Domain controllers · All checks

Invoke-Maester -TestId AD-DOM-03

Overview

Understanding the number and distribution of domain controllers in your domain is critical for:

High Availability: Ensuring sufficient DCs exist to handle authentication load and provide redundancy
Disaster Recovery: Knowing how many DCs need to be recovered in a disaster scenario
Site Coverage: Verifying that all sites have appropriate DC coverage for local authentication
Capacity Planning: Determining if additional DCs are needed based on user and computer growth

Operational

Minimum Redundancy: Maintain at least 2 DCs per domain for fault tolerance
Geographic Distribution: Place DCs strategically across sites to ensure local authentication
RODC Consideration: Consider Read-Only Domain Controllers (RODC) for branch offices
Regular Monitoring: Track DC health and availability as part of your security monitoring

This test retrieves all domain controllers from Active Directory and counts them. It also lists the names of all DCs for easy reference.

Every attribute of this check

Field	Value
Test ID	AD-DOM-03
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Domain controllers
Area	Infrastructure hardening
Resource type	DomainController
MITRE ATT&CK	None
PowerShell test	Test-MtAdDomainControllerCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:domainDNS.name:ReadProperty, ActiveDirectory:Ldap:nTDSDSA:ReadProperty