Well-known security principals count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Directory configuration · All checks

Run this check

Invoke-Maester -TestId AD-CFG-10

Overview

Well-known security principals are built-in identities with special meaning in Active Directory (for example, principals that Windows and AD components rely on for system behavior). Unexpected changes to these principals can indicate tampering, malicious SID/object replacement, or unauthorized directory modification.

Control Type

Operational

Security Recommendation

• Validate that only the expected well-known principals exist (default is 27 for typical configurations).
• Restrict permissions to the container(s) holding well-known principals so only AD administrators can modify them.
• Audit changes by enabling directory change auditing and reviewing security event logs for modifications.
• Investigate any deviation immediately as a potential sign of directory tampering.

How the Test Works

• Locates the AD container(s) that store well-known security principal objects.
• Enumerates those objects and counts how many are present.
• Compares the count to the expected baseline (default 27) and flags any unexpected values.

Related Tests

• Test-MtAdAdActivationObjectsCount: Detects unexpected AD configuration objects that can reflect tampering.
• Test-MtAdTrustedRootCaCount: Identifies unauthorized trust anchors that can undermine authentication integrity.

Details

Every attribute of this check

Field	Value
Test ID	AD-CFG-10
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Directory configuration
Area	Infrastructure hardening
Resource type	Tenant
MITRE ATT&CK	None
PowerShell test	Test-MtAdWellKnownSecurityPrincipalsCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:Configuration/*:ReadProperty

Source

• Test: tests/ad/config/Test.AD-CFG-10.ps1
• Documentation: tests/ad/config/Test.AD-CFG-10.md