Skip to main content
Version: 2.2.1-preview

AD-GMC-01 - Distinct groups with members count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Understanding which groups have members versus empty groups provides valuable insights into Active Directory utilization:

  • Group Hygiene: Empty groups may represent unused or forgotten groups that could be cleaned up
  • Access Management: Groups with members are actively used for access control and permissions
  • Audit Scope: Focus security reviews on groups that actually grant access to resources
  • Directory Cleanup: Identify candidates for decommissioning or consolidation

Security Recommendation​

Regularly review group membership to identify:

  • Empty groups that can be removed or disabled
  • Groups with unexpectedly few members (potential misconfigurations)
  • Groups with excessive members (may need splitting for better access control)

How the Test Works​

This test analyzes Active Directory groups and counts:

  • Total number of groups in the directory
  • Number of groups that contain at least one member
  • Percentage of groups with members
  • Empty groups (for cleanup candidates)

For performance reasons, the test analyzes the first 100 groups if there are many groups in the directory.

  • Test-MtAdGroupMemberAccountTypeDetails - Breaks down member types across groups
  • Test-MtAdGroupMemberTrustCount - Identifies cross-domain trust members

Test Metadata​

FieldValue
Test IDAD-GMC-01
SeverityInfo
SuiteActive Directory
CategoryAD.Group
PowerShell testTest-MtAdGroupMemberDistinctGroupCount
TagsAD, AD-GMC-01, AD.Group

Source​

  • Pester test: tests/ad/group/Test-MtAdGroupMemberDistinctGroupCount.Tests.ps1
  • PowerShell source: powershell/public/ad/group/Test-MtAdGroupMemberDistinctGroupCount.ps1