# IP site links count should be retrievable

IP site links are the standard replication transport for Active Directory.

Source: https://maester.dev/docs/tests/AD-CFG-24

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Sites and subnets · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-CFG-24
```

## Overview

IP site links are the standard replication transport for Active Directory. They typically use direct network communication (e.g., RPC over IP) that can be secured with conventional network controls, firewall rules, and monitoring.

Monitoring the IP site link *count* helps ensure your replication topology is using the intended, more controllable transport mechanism and highlights drift where legacy or less secure transports might be taking precedence.

This test helps answer:
- Are there the expected number of IP site links?
- Is replication configuration moving away from the preferred transport?

#### Control Type

**Operational**

#### Security Recommendation
- Ensure replication uses IP-based transports wherever possible.
- Keep firewall rules tight between domain controllers and validate required ports/paths.
- Compare IP site link configuration against your designed replication topology; investigate unexpected changes.

#### How the Test Works
The test queries AD site link configuration entries using IP as the replication transport and returns the number of IP-based site links.

#### Related Tests
- [Test-MtAdSmtpSiteLinksCount](/docs/commands/Test-MtAdSmtpSiteLinksCount)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-CFG-24 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Sites and subnets |
| Area | Infrastructure hardening |
| Resource type | AdSite |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdIpSiteLinksCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-24.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |

</details>

## Source

- Test: [`tests/ad/config/Test.AD-CFG-24.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-24.ps1)
- Documentation: [`tests/ad/config/Test.AD-CFG-24.md`](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-24.md)