Sites without subnet associations count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Sites and subnets · All checks

Run this check

Invoke-Maester -TestId AD-SITE-04

Overview

Sites without subnet associations cannot be used for client site assignment:

• Authentication inefficiency: Clients may authenticate to distant DCs
• Replication issues: Site topology may not reflect actual network boundaries
• Configuration gaps: Sites may have been created incompletely
• Client confusion: Computers cannot determine their site membership

Every site that should be used for client location must have at least one subnet assigned.

Control Type

Operational

Security Recommendation

• Assign appropriate subnets to all production sites
• Remove sites that are no longer needed
• Ensure subnet assignments accurately reflect network boundaries
• Review site-subnet mappings during network changes

How the Test Works

This test analyzes subnet-to-site associations to identify sites that have no subnets assigned to them.

Related Tests

• Test-MtAdSiteWithoutSubnetDetails - Lists sites without subnet associations
• Test-MtAdSubnetWithoutSiteCount - Identifies orphaned subnets
• Test-MtAdSiteTotalCount - Counts total sites in the domain

Details

Every attribute of this check

Field	Value
Test ID	AD-SITE-04
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Sites and subnets
Area	Infrastructure hardening
Resource type	AdSite
MITRE ATT&CK	None
PowerShell test	Test-MtAdSiteWithoutSubnetCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:site:ReadProperty, ActiveDirectory:Ldap:subnet:ReadProperty

Source

• Test: tests/ad/site/Test.AD-SITE-04.ps1
• Documentation: tests/ad/site/Test.AD-SITE-04.md