AD-DOM-03: Domain controller count should be retrievable
| ID | AD-DOM-03 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Domain controllers |
| Security area | Infrastructure hardening |
| Resource type | DomainController |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Understanding the number and distribution of domain controllers in your domain is critical for:
- High Availability: Ensuring sufficient DCs exist to handle authentication load and provide redundancy
- Disaster Recovery: Knowing how many DCs need to be recovered in a disaster scenario
- Site Coverage: Verifying that all sites have appropriate DC coverage for local authentication
- Capacity Planning: Determining if additional DCs are needed based on user and computer growth
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Minimum Redundancy: Maintain at least 2 DCs per domain for fault tolerance
- Geographic Distribution: Place DCs strategically across sites to ensure local authentication
- RODC Consideration: Consider Read-Only Domain Controllers (RODC) for branch offices
- Regular Monitoring: Track DC health and availability as part of your security monitoring
How the Test Works
Section titled “How the Test Works”This test retrieves all domain controllers from Active Directory and counts them. It also lists the names of all DCs for easy reference.
Related Tests
Section titled “Related Tests”Test-MtAdDomainFunctionalLevel- Retrieves the domain functional levelTest-MtAdForestDomainCount- Counts domains in the forest
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.