AD-SITE-04: Sites without subnet associations count should be retrievable
| ID | AD-SITE-04 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Sites and subnets |
| Security area | Infrastructure hardening |
| Resource type | AdSite |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Sites without subnet associations cannot be used for client site assignment:
- Authentication inefficiency: Clients may authenticate to distant DCs
- Replication issues: Site topology may not reflect actual network boundaries
- Configuration gaps: Sites may have been created incompletely
- Client confusion: Computers cannot determine their site membership
Every site that should be used for client location must have at least one subnet assigned.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Assign appropriate subnets to all production sites
- Remove sites that are no longer needed
- Ensure subnet assignments accurately reflect network boundaries
- Review site-subnet mappings during network changes
How the Test Works
Section titled “How the Test Works”This test analyzes subnet-to-site associations to identify sites that have no subnets assigned to them.
Related Tests
Section titled “Related Tests”Test-MtAdSiteWithoutSubnetDetails- Lists sites without subnet associationsTest-MtAdSubnetWithoutSiteCount- Identifies orphaned subnetsTest-MtAdSiteTotalCount- Counts total sites in the domain
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.