AD-COMP-08: Computer per OU average should be retrievable
| ID | AD-COMP-08 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Computers |
| Security area | Infrastructure hardening |
| Resource type | OrganizationalUnit |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Understanding the distribution density of computers across OUs helps identify:
- Overloaded OUs: OUs with too many computers may indicate poor structure or policy bottlenecks
- Underutilized OUs: Many OUs with very few computers may indicate unnecessary complexity
- Policy application issues: Uneven distribution can lead to inconsistent security policy application
- Administrative burden: Poor structure increases management overhead
The average, minimum, and maximum computers per OU provide metrics for assessing organizational efficiency.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Aim for a balanced OU structure that:
- Supports your Group Policy design (each OU should have a clear policy purpose)
- Enables delegated administration without excessive granularity
- Can be easily understood and navigated by administrators
- Investigate OUs with unusually high computer counts
- Consider consolidating OUs with very few computers if they serve similar purposes
- Document the OU design rationale for future administrators
How the Test Works
Section titled “How the Test Works”This test groups all enabled computers by their parent container and calculates:
- Average computers per OU
- Minimum computers in any OU
- Maximum computers in any OU
- Distribution across the top containers
Related Tests
Section titled “Related Tests”Test-MtAdComputerOUCount- Counts the total number of OUs with computersTest-MtAdComputerInDefaultContainer- Identifies potential OU structure gaps
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.