Computer non-standard primary group count should be retrievable
AD-COMP-04InfoActive DirectoryComputers
Part of Active Directory · Active Directory · Computers · All checks
Invoke-Maester -TestId AD-COMP-04Overview
Section titled “Overview”Computer accounts should use standard primary group IDs. Non-standard primary groups may indicate:
- Misconfiguration: Computers accidentally assigned to incorrect groups
- Custom security configurations: Potential deviations from security baselines
- Legacy issues: Remnants of previous domain configurations or migrations
- Privilege escalation risks: Computers in inappropriate groups may have excessive permissions
The standard primary groups for computers are:
- 515 - Domain Computers (standard workstations and member servers)
- 516 - Domain Controllers (DC computer accounts)
- 521 - Read-only Domain Controllers (RODC computer accounts)
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Review computers with non-standard primary groups to understand why they deviate
- Ensure custom primary groups are intentional and properly documented
- Verify that computers are not accidentally placed in groups that grant excessive privileges
- Consider standardizing on the default groups unless there’s a specific security requirement
How the Test Works
Section titled “How the Test Works”This test examines the primaryGroupId attribute of all enabled computer accounts and identifies those where the value is not 515, 516, or 521.
Related Tests
Section titled “Related Tests”Test-MtAdComputerSidHistoryCount- Identifies computers with migration artifactsTest-MtAdComputerOUCount- Shows the distribution of computers across OUs
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-COMP-04 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Computers |
| Area | Identity lifecycle and hygiene |
| Resource type | Computer |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdComputerNonStandardGroup |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/computer/Test.AD-COMP-04.ps1 - Documentation:
tests/ad/computer/Test.AD-COMP-04.md