RIDs remaining should be retrievable
AD-DOM-04InfoActive DirectoryDomain and forest
Part of Active Directory · Active Directory · Domain and forest · All checks
Invoke-Maester -TestId AD-DOM-04Overview
Section titled “Overview”RIDs (Relative Identifiers) are essential for creating unique Security Identifiers (SIDs) for every user, group, and computer in Active Directory. Each domain has a finite pool of approximately 1 billion RIDs:
- SID Exhaustion: Running out of RIDs would prevent creation of any new security principals
- Business Impact: New users, groups, or computers could not be created
- Recovery Complexity: RID pool exhaustion requires complex forest recovery procedures
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Monitor RID consumption regularly:
- Normal Usage: Most domains use only a small fraction of available RIDs over their lifetime
- High Consumption: Rapid RID consumption may indicate:
- Excessive computer account creation/deletion cycles
- Automated provisioning scripts creating many accounts
- Security issues like computer account flooding attacks
- Threshold Alerting: Set alerts when RID usage exceeds 50% (very conservative) or 75%
If RID consumption is unexpectedly high:
- Investigate the source of high account creation
- Review computer join policies and scripts
- Consider implementing stricter controls on account creation
How the Test Works
Section titled “How the Test Works”This test retrieves the RID available pool from Active Directory and calculates the remaining RIDs. The RID pool is a 64-bit value where the high 32 bits represent the total pool and the low 32 bits represent used RIDs.
Related Tests
Section titled “Related Tests”Test-MtAdDomainControllerCount- Counts domain controllers (RID masters)Test-MtAdMachineAccountQuota- Checks machine account creation limits
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DOM-04 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain and forest |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdRidsRemaining |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:domainDNS.rIDAvailablePool:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/domain/Test.AD-DOM-04.ps1 - Documentation:
tests/ad/domain/Test.AD-DOM-04.md