Skip to main content
Version: 2.2.1-preview

AD-SITE-03 - Sites without domain controllers details should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Understanding which specific sites lack domain controllers is essential for:

  • Capacity planning: Identifying locations that may need DC deployment
  • Troubleshooting: Pinpointing sites that may experience authentication issues
  • Documentation: Maintaining accurate records of DC deployment status
  • Risk assessment: Evaluating the impact of WAN failures on authentication

Each site without a DC represents a potential single point of failure for authentication in that location.

Security Recommendation​

For each site without a DC:

  1. Verify if the site represents an active physical location
  2. Assess the reliability and bandwidth of WAN connectivity
  3. Consider deploying an RODC if the site has users or resources
  4. Document the rationale for not having a local DC
  5. Monitor authentication latency from these sites

How the Test Works​

This test retrieves all sites and domain controllers, then identifies and lists specific sites that have no associated domain controllers.

  • Test-MtAdSiteWithoutDcCount - Counts sites without DCs
  • Test-MtAdSiteTotalCount - Counts total sites in the domain

Test Metadata​

FieldValue
Test IDAD-SITE-03
SeverityInfo
SuiteActive Directory
CategoryAD.Site
PowerShell testTest-MtAdSiteWithoutDcDetails
TagsAD, AD-SITE-03, AD.Site

Source​

  • Pester test: tests/ad/site/Test-MtAdSiteWithoutDcDetails.Tests.ps1
  • PowerShell source: powershell/public/ad/site/Test-MtAdSiteWithoutDcDetails.ps1