# DC site coverage count should be retrievable

Active Directory sites are used to define the physical topology of your network and optimize authentication traffic.

Source: https://maester.dev/docs/tests/AD-DC-01

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Domain controllers · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-DC-01
```

## Overview

Active Directory sites are used to define the physical topology of your network and optimize authentication traffic. Understanding site coverage helps ensure:

- **Geographic redundancy**: Authentication services are available in all locations
- **Network efficiency**: Clients authenticate to the nearest DC
- **Disaster recovery**: Multiple sites provide failover capabilities
- **Capacity planning**: Proper distribution of DCs across sites

Sites without domain controllers may indicate:
- Hub-and-spoke topology where remote sites rely on central DCs
- Misconfigured site topology
- Missing DCs in satellite offices

#### Control Type

**Operational**

#### Security Recommendation

Review your site topology regularly to ensure all locations have adequate DC coverage. Consider placing at least one DC in each major geographic location to ensure authentication resilience.

#### How the Test Works

This test retrieves all domain controllers and counts the unique sites that contain at least one DC. It compares this to the total number of sites in the domain.

#### Related Tests

- `Test-MtAdDomainControllerCount` - Total count of domain controllers
- `Test-MtAdDcOperatingSystemDetails` - DC OS distribution information

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-DC-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain controllers |
| Area | Infrastructure hardening |
| Resource type | AdSite |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdDcSiteCoverageCount](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DC-01.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty, ActiveDirectory:Ldap:site:ReadProperty |

</details>

## Source

- Test: [`tests/ad/domain-controller/Test.AD-DC-01.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DC-01.ps1)
- Documentation: [`tests/ad/domain-controller/Test.AD-DC-01.md`](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DC-01.md)