AD-SITE-05: Sites without subnet associations details should be retrievable
| ID | AD-SITE-05 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Sites and subnets |
| Security area | Infrastructure hardening |
| Resource type | AdSite |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Sites without subnets represent incomplete configuration that can lead to:
- Client mislocation: Computers may authenticate to incorrect DCs
- Replication inefficiency: Site topology doesn’t guide replication paths
- Service location failures: Clients cannot locate local services
- Administrative confusion: Sites exist but cannot be used
Identifying and resolving these configuration gaps ensures the site topology functions correctly.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”For each site without subnets:
- Determine if the site represents an active location
- If active, assign appropriate subnet(s) to the site
- If inactive, consider deleting the site
- Document the purpose of each site
- Validate that subnet assignments match actual network topology
How the Test Works
Section titled “How the Test Works”This test retrieves all sites and subnets, identifies sites with no subnet associations, and lists them with their descriptions.
Related Tests
Section titled “Related Tests”Test-MtAdSiteWithoutSubnetCount- Counts sites without subnetsTest-MtAdSubnetWithoutSiteCount- Counts orphaned subnetsTest-MtAdSiteTotalCount- Counts total sites in the domain
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.