Sites without domain controllers details should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Sites and subnets · All checks

Run this check

Invoke-Maester -TestId AD-SITE-03

Overview

Understanding which specific sites lack domain controllers is essential for:

• Capacity planning: Identifying locations that may need DC deployment
• Troubleshooting: Pinpointing sites that may experience authentication issues
• Documentation: Maintaining accurate records of DC deployment status
• Risk assessment: Evaluating the impact of WAN failures on authentication

Each site without a DC represents a potential single point of failure for authentication in that location.

Control Type

Operational

Security Recommendation

For each site without a DC:

1. Verify if the site represents an active physical location
2. Assess the reliability and bandwidth of WAN connectivity
3. Consider deploying an RODC if the site has users or resources
4. Document the rationale for not having a local DC
5. Monitor authentication latency from these sites

How the Test Works

This test retrieves all sites and domain controllers, then identifies and lists specific sites that have no associated domain controllers.

Related Tests

• Test-MtAdSiteWithoutDcCount - Counts sites without DCs
• Test-MtAdSiteTotalCount - Counts total sites in the domain

Details

Every attribute of this check

Field	Value
Test ID	AD-SITE-03
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Sites and subnets
Area	Infrastructure hardening
Resource type	AdSite
MITRE ATT&CK	None
PowerShell test	Test-MtAdSiteWithoutDcDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:nTDSDSA:ReadProperty, ActiveDirectory:Ldap:site:ReadProperty

Source

• Test: tests/ad/site/Test.AD-SITE-03.ps1
• Documentation: tests/ad/site/Test.AD-SITE-03.md