Sites without subnet associations details should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Sites and subnets · All checks

Run this check

Invoke-Maester -TestId AD-SITE-05

Overview

Sites without subnets represent incomplete configuration that can lead to:

• Client mislocation: Computers may authenticate to incorrect DCs
• Replication inefficiency: Site topology doesn’t guide replication paths
• Service location failures: Clients cannot locate local services
• Administrative confusion: Sites exist but cannot be used

Identifying and resolving these configuration gaps ensures the site topology functions correctly.

Control Type

Operational

Security Recommendation

For each site without subnets:

1. Determine if the site represents an active location
2. If active, assign appropriate subnet(s) to the site
3. If inactive, consider deleting the site
4. Document the purpose of each site
5. Validate that subnet assignments match actual network topology

How the Test Works

This test retrieves all sites and subnets, identifies sites with no subnet associations, and lists them with their descriptions.

Related Tests

• Test-MtAdSiteWithoutSubnetCount - Counts sites without subnets
• Test-MtAdSubnetWithoutSiteCount - Counts orphaned subnets
• Test-MtAdSiteTotalCount - Counts total sites in the domain

Details

Every attribute of this check

Field	Value
Test ID	AD-SITE-05
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Sites and subnets
Area	Infrastructure hardening
Resource type	AdSite
MITRE ATT&CK	None
PowerShell test	Test-MtAdSiteWithoutSubnetDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:site:ReadProperty, ActiveDirectory:Ldap:subnet:ReadProperty

Source

• Test: tests/ad/site/Test.AD-SITE-05.ps1
• Documentation: tests/ad/site/Test.AD-SITE-05.md