# Sites without domain controllers details should be retrievable

Understanding which specific sites lack domain controllers is essential for:

Source: https://maester.dev/docs/tests/AD-SITE-03

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Sites and subnets · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-SITE-03
```

## Overview

Understanding which specific sites lack domain controllers is essential for:

- **Capacity planning**: Identifying locations that may need DC deployment
- **Troubleshooting**: Pinpointing sites that may experience authentication issues
- **Documentation**: Maintaining accurate records of DC deployment status
- **Risk assessment**: Evaluating the impact of WAN failures on authentication

Each site without a DC represents a potential single point of failure for authentication in that location.

#### Control Type

**Operational**

#### Security Recommendation

For each site without a DC:
1. Verify if the site represents an active physical location
2. Assess the reliability and bandwidth of WAN connectivity
3. Consider deploying an RODC if the site has users or resources
4. Document the rationale for not having a local DC
5. Monitor authentication latency from these sites

#### How the Test Works

This test retrieves all sites and domain controllers, then identifies and lists specific sites that have no associated domain controllers.

#### Related Tests

- `Test-MtAdSiteWithoutDcCount` - Counts sites without DCs
- `Test-MtAdSiteTotalCount` - Counts total sites in the domain

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-SITE-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Sites and subnets |
| Area | Infrastructure hardening |
| Resource type | AdSite |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdSiteWithoutDcDetails](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SITE-03.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty, ActiveDirectory:Ldap:site:ReadProperty |

</details>

## Source

- Test: [`tests/ad/site/Test.AD-SITE-03.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SITE-03.ps1)
- Documentation: [`tests/ad/site/Test.AD-SITE-03.md`](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SITE-03.md)