Distinct groups with members count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Groups · All checks

Run this check

Invoke-Maester -TestId AD-GMC-01

Overview

Understanding which groups have members versus empty groups provides valuable insights into Active Directory utilization:

• Group Hygiene: Empty groups may represent unused or forgotten groups that could be cleaned up
• Access Management: Groups with members are actively used for access control and permissions
• Audit Scope: Focus security reviews on groups that actually grant access to resources
• Directory Cleanup: Identify candidates for decommissioning or consolidation

Control Type

Operational

Security Recommendation

Regularly review group membership to identify:

• Empty groups that can be removed or disabled
• Groups with unexpectedly few members (potential misconfigurations)
• Groups with excessive members (may need splitting for better access control)

How the Test Works

This test analyzes Active Directory groups and counts:

• Total number of groups in the directory
• Number of groups that contain at least one member
• Percentage of groups with members
• Empty groups (for cleanup candidates)

For performance reasons, the test analyzes the first 100 groups if there are many groups in the directory.

Related Tests

• Test-MtAdGroupMemberAccountTypeDetails - Breaks down member types across groups
• Test-MtAdGroupMemberTrustCount - Identifies cross-domain trust members

Details

Every attribute of this check

Field	Value
Test ID	AD-GMC-01
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Groups
Area	Identity lifecycle and hygiene
Resource type	Group
MITRE ATT&CK	None
PowerShell test	Test-MtAdGroupMemberDistinctGroupCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty

Source

• Test: tests/ad/group/Test.AD-GMC-01.ps1
• Documentation: tests/ad/group/Test.AD-GMC-01.md