AD-SUB-11: Subnets without site associations count should be retrievable
| ID | AD-SUB-11 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Sites and subnets |
| Security area | Infrastructure hardening |
| Resource type | AdSite |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Subnets without site associations (orphaned subnets) can cause:
- Client mislocation: Computers with these IPs cannot determine their site
- Authentication inefficiency: Clients may authenticate to distant DCs
- Configuration drift: Orphaned subnets may indicate incomplete cleanup
- Operational confusion: Unclear which locations these subnets serve
Orphaned subnets should be either assigned to sites or removed.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Assign orphaned subnets to appropriate sites
- Remove subnets that are no longer in use
- Review subnet assignments during network changes
- Document the purpose and location of all subnets
How the Test Works
Section titled “How the Test Works”This test identifies subnets that have no site association (SiteObject is null).
Related Tests
Section titled “Related Tests”Test-MtAdSiteWithoutSubnetCount- Identifies sites without subnetsTest-MtAdSubnetSiteAssociationCount- Counts sites with subnetsTest-MtAdSubnetTotalCount- Counts total subnets
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.