AD-SUB-03: Catch-all subnets count should be retrievable
| ID | AD-SUB-03 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Sites and subnets |
| Security area | Infrastructure hardening |
| Resource type | AdSite |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Catch-all subnets (overly broad IP ranges) can cause:
- Authentication inefficiency: Clients may authenticate to distant DCs
- WAN congestion: Unnecessary cross-site authentication traffic
- Security concerns: Difficult to track and audit client locations
- Operational confusion: Site boundaries don’t reflect actual topology
Common catch-all subnets include 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Replace catch-all subnets with specific, appropriately-sized subnets
- Use /24 or smaller subnets for most locations
- Document exceptions where catch-all subnets are intentionally used
- Review subnet definitions during network planning
How the Test Works
Section titled “How the Test Works”This test identifies subnets with overly broad CIDR notation that could encompass multiple physical locations.
Related Tests
Section titled “Related Tests”Test-MtAdSubnetNonInternalCount- Identifies public IP subnetsTest-MtAdSubnetTotalCount- Counts total subnetsTest-MtAdSiteWithoutSubnetCount- Identifies sites without subnets
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.