Cross-forest references count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Domain and forest · All checks

Run this check

Invoke-Maester -TestId AD-FORS-04

Overview

Cross-forest references represent security principals (users, groups, computers) from trusted external forests that have been granted access to resources in the local forest. Understanding cross-forest references is critical for:

• Trust Management: Cross-forest references indicate active trust relationships that must be monitored and maintained
• Security Boundaries: External forest references expand the security boundary beyond the local forest
• Access Control: References from external forests may have access to local resources; these must be regularly audited
• Compliance: Many compliance frameworks require documentation and monitoring of cross-forest access
• Risk Assessment: Unknown or unexpected cross-forest references could indicate security compromise or misconfiguration

Control Type

Operational

Security Recommendation

If cross-forest references exist:

1. Inventory and Document: Maintain an inventory of all cross-forest references and their purposes
2. Regular Review: Review cross-forest references quarterly to ensure they are still needed
3. Trust Verification: Verify that trusts with external forests are still required and properly secured
4. Access Audit: Audit what resources cross-forest principals can access in the local forest
5. Monitor for Changes: Set up alerting for new cross-forest references, which could indicate unauthorized access provisioning

How the Test Works

This test retrieves cross-forest reference information from the forest configuration using Get-ADForest. It counts the number of cross-forest references and reports whether any external forest principals have been granted access to local resources.

Related Tests

• Test-MtAdTrustTotalCount - Checks for configured domain trusts
• Test-MtAdTrustDetails - Provides detailed trust configuration information

Details

Every attribute of this check

Field	Value
Test ID	AD-FORS-04
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Domain and forest
Area	External access and sharing
Resource type	Tenant
MITRE ATT&CK	None
PowerShell test	Test-MtAdCrossForestReferencesCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:crossRef:ReadProperty

Source

• Test: tests/ad/domain/Test.AD-FORS-04.ps1
• Documentation: tests/ad/domain/Test.AD-FORS-04.md