AD-COMP-06: Computer default container count should be retrievable


ID	`AD-COMP-06`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Computers
Security area	Infrastructure hardening
Resource type	Computer
Reads from	On-premises Active Directory

What this checks and how to fix it

Computers located in the default CN=Computers container represent a security and management concern:

No Group Policy inheritance: The Computers container is not an OU, so it doesn’t support Group Policy inheritance
Management gaps: Computers in the default container may not receive security policies, software updates, or configurations
Provisioning issues: Indicates the domain join process hasn’t been customized or automated provisioning is failing
Shadow IT: May represent unauthorized systems joined to the domain

Control Type

Detective

Security Recommendation

Move all computers from the default Computers container into appropriate OUs based on:
- Geographic location
- Department or function
- Security requirements
Implement a standardized domain join process that places computers in the correct OU
Use redircmp.exe to redirect new computer accounts to a specific OU
Regularly audit the default container for new additions

How the Test Works

This test identifies enabled computer accounts where the Distinguished Name contains CN=Computers, indicating they are in the default Computers container rather than a proper organizational unit.

Test-MtAdComputerOUCount - Shows the distribution of computers across OUs
Test-MtAdComputerPerOUAverage - Analyzes OU structure effectiveness

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).