Site total count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Sites and subnets · All checks

Run this check

Invoke-Maester -TestId AD-SITE-01

Overview

Active Directory sites represent the physical topology of your network and are fundamental to:

• Authentication efficiency: Clients authenticate to domain controllers in their local site
• Replication optimization: Directory data replicates between sites on a controlled schedule
• Service location: Clients locate services (like DFS, Exchange) in their local site
• Bandwidth conservation: Site-aware applications minimize WAN traffic

Understanding the number and distribution of sites helps assess whether your Active Directory topology accurately reflects your physical network infrastructure.

Control Type

Operational

Security Recommendation

Ensure that:

• Sites exist for all physical locations with domain resources
• Site topology is reviewed periodically as the network evolves
• Sites are properly named to reflect their geographic location
• Unused sites are removed to prevent confusion

How the Test Works

This test retrieves all Active Directory sites using Get-ADReplicationSite and counts the total number of sites configured in the domain.

Related Tests

• Test-MtAdSiteWithoutDcCount - Identifies sites without domain controllers
• Test-MtAdSiteWithoutSubnetCount - Identifies sites without subnet associations
• Test-MtAdDcSiteCoverageCount - Analyzes DC distribution across sites

Details

Every attribute of this check

Field	Value
Test ID	AD-SITE-01
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Sites and subnets
Area	Infrastructure hardening
Resource type	AdSite
MITRE ATT&CK	None
PowerShell test	Test-MtAdSiteTotalCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:site:ReadProperty

Source

• Test: tests/ad/site/Test.AD-SITE-01.ps1
• Documentation: tests/ad/site/Test.AD-SITE-01.md