AD-SITE-01: Site total count should be retrievable


ID	`AD-SITE-01`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Sites and subnets
Security area	Infrastructure hardening
Resource type	AdSite
Reads from	On-premises Active Directory

What this checks and how to fix it

Active Directory sites represent the physical topology of your network and are fundamental to:

Authentication efficiency: Clients authenticate to domain controllers in their local site
Replication optimization: Directory data replicates between sites on a controlled schedule
Service location: Clients locate services (like DFS, Exchange) in their local site
Bandwidth conservation: Site-aware applications minimize WAN traffic

Understanding the number and distribution of sites helps assess whether your Active Directory topology accurately reflects your physical network infrastructure.

Control Type

Operational

Security Recommendation

Ensure that:

Sites exist for all physical locations with domain resources
Site topology is reviewed periodically as the network evolves
Sites are properly named to reflect their geographic location
Unused sites are removed to prevent confusion

How the Test Works

This test retrieves all Active Directory sites using Get-ADReplicationSite and counts the total number of sites configured in the domain.

Test-MtAdSiteWithoutDcCount - Identifies sites without domain controllers
Test-MtAdSiteWithoutSubnetCount - Identifies sites without subnet associations
Test-MtAdDcSiteCoverageCount - Analyzes DC distribution across sites

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).