Skip to main content
Version: 2.2.1-preview

AD-GCHG-01 - Average group membership changes per year should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Understanding the rate of group membership changes provides insights into:

  • Operational tempo: How frequently group memberships change
  • Security monitoring: Baseline for detecting anomalous activity
  • Compliance trends: Track changes over time for audit purposes
  • Change management: Identify periods of high activity
  • Lifecycle management: Understand group creation and modification patterns

Security Recommendation​

Monitor group membership changes for security anomalies:

  • Establish baselines for normal change rates
  • Alert on changes that exceed normal thresholds
  • Review spikes in activity for unauthorized changes
  • Correlate group changes with change management tickets
  • Implement approval workflows for privileged group changes
  • Document business reasons for high-volume change periods

How the Test Works​

This test analyzes group metadata to calculate:

  • Total groups in the directory
  • Timespan since oldest group was created
  • Average number of group modifications per year
  • Breakdown of creations and modifications by year
  • Groups modified within the last 90 days

The analysis helps identify trends and patterns in group management activity.

  • Test-MtAdGroupPrivilegedWithMembersDetails - Reviews current privileged group state
  • Test-MtAdGroupEmptyNonPrivilegedDetails - Identifies potentially stale groups

Test Metadata​

FieldValue
Test IDAD-GCHG-01
SeverityInfo
SuiteActive Directory
CategoryAD.Group
PowerShell testTest-MtAdGroupChangeAveragePerYear
TagsAD, AD-GCHG-01, AD.GCHG, AD.Group

Source​

  • Pester test: tests/ad/group/Test-MtAdGroupChangeAveragePerYear.Tests.ps1
  • PowerShell source: powershell/public/ad/group/Test-MtAdGroupChangeAveragePerYear.ps1