AD-DC-01: DC site coverage count should be retrievable
| ID | AD-DC-01 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Domain controllers |
| Security area | Infrastructure hardening |
| Resource type | AdSite |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Active Directory sites are used to define the physical topology of your network and optimize authentication traffic. Understanding site coverage helps ensure:
- Geographic redundancy: Authentication services are available in all locations
- Network efficiency: Clients authenticate to the nearest DC
- Disaster recovery: Multiple sites provide failover capabilities
- Capacity planning: Proper distribution of DCs across sites
Sites without domain controllers may indicate:
- Hub-and-spoke topology where remote sites rely on central DCs
- Misconfigured site topology
- Missing DCs in satellite offices
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review your site topology regularly to ensure all locations have adequate DC coverage. Consider placing at least one DC in each major geographic location to ensure authentication resilience.
How the Test Works
Section titled “How the Test Works”This test retrieves all domain controllers and counts the unique sites that contain at least one DC. It compares this to the total number of sites in the domain.
Related Tests
Section titled “Related Tests”Test-MtAdDomainControllerCount- Total count of domain controllersTest-MtAdDcOperatingSystemDetails- DC OS distribution information
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.