Sites without domain controllers count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Sites and subnets · All checks

Run this check

Invoke-Maester -TestId AD-SITE-02

Overview

Sites without domain controllers may indicate:

• Authentication delays: Clients in these sites must authenticate across the WAN to another site
• Single points of failure: If the WAN link fails, clients cannot authenticate
• Incomplete deployment: Sites may have been created but DCs were never deployed
• Resource gaps: Branch offices may lack local domain controller presence

Sites without DCs should be carefully evaluated to ensure they represent intentional design decisions rather than configuration gaps.

Control Type

Operational

Security Recommendation

For sites without domain controllers:

• Consider deploying RODCs (Read-Only Domain Controllers) in branch offices
• Ensure WAN links are reliable and have adequate bandwidth
• Document the business justification for sites without local DCs
• Monitor authentication traffic from these sites

How the Test Works

This test compares the list of sites with domain controllers against all sites in the domain to identify sites that have no DC presence.

Related Tests

• Test-MtAdSiteWithoutDcDetails - Lists the specific sites without DCs
• Test-MtAdSiteTotalCount - Counts total sites in the domain
• Test-MtAdDcSiteCoverageCount - Analyzes DC distribution across sites

Details

Every attribute of this check

Field	Value
Test ID	AD-SITE-02
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Sites and subnets
Area	Infrastructure hardening
Resource type	AdSite
MITRE ATT&CK	None
PowerShell test	Test-MtAdSiteWithoutDcCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:nTDSDSA:ReadProperty, ActiveDirectory:Ldap:site:ReadProperty

Source

• Test: tests/ad/site/Test.AD-SITE-02.ps1
• Documentation: tests/ad/site/Test.AD-SITE-02.md