Controls/EDCA-RES-013.json

{
  "id": "EDCA-RES-013",
  "title": "DAG is not stretched beyond two Active Directory sites",
  "description": "Each Database Availability Group (DAG) SHOULD be deployed across no more than two Active Directory sites. Stretching a DAG beyond two sites increases failover complexity and can reduce operational predictability during site-level incidents.",
  "verify": true,
  "subject": "Organization",
  "category": "Resilience",
  "severity": "Medium",
  "severityWeight": 6,
  "frameworks": [
    "Best Practice"
  ],
  "references": [
    {
      "name": "Exchange Server Preferred Architecture: Database availability group design",
      "url": "https://learn.microsoft.com/en-us/exchange/plan-and-deploy/deployment-ref/preferred-architecture"
    },
    {
      "name": "Database availability groups (DAGs)",
      "url": "https://learn.microsoft.com/en-us/exchange/high-availability/database-availability-groups/database-availability-groups"
    }
  ],
  "remediation": {
    "automatable": false,
    "description": "Consolidate DAG membership to one or two Active Directory sites. If more than two sites are in use, redesign DAG topology to align with a site-resilient datacenter pair model.",
    "scriptTemplate": "# Diagnose: Show DAG membership and AD site distribution\nGet-ExchangeServer | Where-Object { $_.MemberOfDAG } | Select-Object Name, MemberOfDAG, Site | Sort-Object MemberOfDAG, Site, Name | Format-Table -AutoSize"
  },
  "considerations": "If no DAG is deployed, this control is not applicable and should report Skipped. In single-site environments with one DAG site, this control can still pass because it enforces an upper bound (not more than two sites).",
  "roles": [
    "Mailbox"
  ]
}