AD-SITE-02: Sites without domain controllers count should be retrievable
| ID | AD-SITE-02 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Sites and subnets |
| Security area | Infrastructure hardening |
| Resource type | AdSite |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Sites without domain controllers may indicate:
- Authentication delays: Clients in these sites must authenticate across the WAN to another site
- Single points of failure: If the WAN link fails, clients cannot authenticate
- Incomplete deployment: Sites may have been created but DCs were never deployed
- Resource gaps: Branch offices may lack local domain controller presence
Sites without DCs should be carefully evaluated to ensure they represent intentional design decisions rather than configuration gaps.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”For sites without domain controllers:
- Consider deploying RODCs (Read-Only Domain Controllers) in branch offices
- Ensure WAN links are reliable and have adequate bandwidth
- Document the business justification for sites without local DCs
- Monitor authentication traffic from these sites
How the Test Works
Section titled “How the Test Works”This test compares the list of sites with domain controllers against all sites in the domain to identify sites that have no DC presence.
Related Tests
Section titled “Related Tests”Test-MtAdSiteWithoutDcDetails- Lists the specific sites without DCsTest-MtAdSiteTotalCount- Counts total sites in the domainTest-MtAdDcSiteCoverageCount- Analyzes DC distribution across sites
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.