AD-SITE-03: Sites without domain controllers details should be retrievable
| ID | AD-SITE-03 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Sites and subnets |
| Security area | Infrastructure hardening |
| Resource type | AdSite |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Understanding which specific sites lack domain controllers is essential for:
- Capacity planning: Identifying locations that may need DC deployment
- Troubleshooting: Pinpointing sites that may experience authentication issues
- Documentation: Maintaining accurate records of DC deployment status
- Risk assessment: Evaluating the impact of WAN failures on authentication
Each site without a DC represents a potential single point of failure for authentication in that location.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”For each site without a DC:
- Verify if the site represents an active physical location
- Assess the reliability and bandwidth of WAN connectivity
- Consider deploying an RODC if the site has users or resources
- Document the rationale for not having a local DC
- Monitor authentication latency from these sites
How the Test Works
Section titled “How the Test Works”This test retrieves all sites and domain controllers, then identifies and lists specific sites that have no associated domain controllers.
Related Tests
Section titled “Related Tests”Test-MtAdSiteWithoutDcCount- Counts sites without DCsTest-MtAdSiteTotalCount- Counts total sites in the domain
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.