Catch-all subnets count should be retrievable
AD-SUB-03InfoActive DirectorySites and subnets
Part of Active Directory · Active Directory · Sites and subnets · All checks
Invoke-Maester -TestId AD-SUB-03Overview
Section titled “Overview”Catch-all subnets (overly broad IP ranges) can cause:
- Authentication inefficiency: Clients may authenticate to distant DCs
- WAN congestion: Unnecessary cross-site authentication traffic
- Security concerns: Difficult to track and audit client locations
- Operational confusion: Site boundaries don’t reflect actual topology
Common catch-all subnets include 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Replace catch-all subnets with specific, appropriately-sized subnets
- Use /24 or smaller subnets for most locations
- Document exceptions where catch-all subnets are intentionally used
- Review subnet definitions during network planning
How the Test Works
Section titled “How the Test Works”This test identifies subnets with overly broad CIDR notation that could encompass multiple physical locations.
Related Tests
Section titled “Related Tests”Test-MtAdSubnetNonInternalCount- Identifies public IP subnetsTest-MtAdSubnetTotalCount- Counts total subnetsTest-MtAdSiteWithoutSubnetCount- Identifies sites without subnets
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-SUB-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Sites and subnets |
| Area | Infrastructure hardening |
| Resource type | AdSite |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdSubnetCatchAllCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:subnet:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/site/Test.AD-SUB-03.ps1 - Documentation:
tests/ad/site/Test.AD-SUB-03.md