Distinct account types of members count should be retrievable
AD-GMC-02InfoActive DirectoryGroups
Part of Active Directory · Active Directory · Groups · All checks
Invoke-Maester -TestId AD-GMC-02Overview
Section titled “Overview”- Understanding the types of objects that can be group members helps assess Active Directory security posture:
- Security Principal Types: Groups can contain users, groups, computers, and foreign security principals
- Nested Groups: Groups containing other groups create inheritance chains that can be complex to audit
- Computer Membership: Computers in groups may indicate service accounts or special access requirements
- Foreign Principals: External domain members represent trust relationships that extend beyond the local domain
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Monitor group membership composition:
- Nested group membership can create unexpected access paths
- Foreign security principals indicate cross-domain access that should be regularly reviewed
- Computer accounts in sensitive groups may indicate misconfigurations
How the Test Works
Section titled “How the Test Works”- This test analyzes group membership across Active Directory and:
- Identifies distinct object classes among group members
- Counts unique account types (user, group, computer, foreignSecurityPrincipal)
- Provides visibility into membership composition
For performance reasons, the test analyzes members from the first 50 groups and deduplicates by SID.
Related Tests
Section titled “Related Tests”Test-MtAdGroupMemberAccountTypeDetails- Detailed breakdown of account typesTest-MtAdGroupMemberForeignSidCount- Identifies foreign security principals specifically
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GMC-02 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Groups |
| Area | Identity lifecycle and hygiene |
| Resource type | Group |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdGroupMemberAccountTypeCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/group/Test.AD-GMC-02.ps1 - Documentation:
tests/ad/group/Test.AD-GMC-02.md