Member account types breakdown should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Groups · All checks

Run this check

Invoke-Maester -TestId AD-GMC-03

Overview

A detailed breakdown of account types across group membership provides comprehensive visibility:

• User Accounts: Most common members - represent individual access
• Group Nesting: Groups within groups create hierarchical permissions
• Computer Accounts: Service accounts and system access requirements
• Foreign Security Principals: Cross-domain and cross-forest access

Control Type

Operational

Security Recommendation

Review account type distributions to identify:

• Over-reliance on group nesting that may create privilege escalation paths
• Unusual patterns (e.g., many computer accounts in privileged groups)
• External principals that may need periodic trust validation

How the Test Works

This test provides a detailed analysis of group membership composition:

• Categorizes all unique members by their object class
• Shows count and percentage for each account type
• Identifies the distribution of member types across groups

For performance reasons, the test analyzes members from the first 50 groups and deduplicates by SID.

Related Tests

• Test-MtAdGroupMemberAccountTypeCount - Count of distinct account types
• Test-MtAdGroupMemberTrustDetails - Detailed view of trust members by group

Details

Every attribute of this check

Field	Value
Test ID	AD-GMC-03
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Groups
Area	Identity lifecycle and hygiene
Resource type	Group
MITRE ATT&CK	None
PowerShell test	Test-MtAdGroupMemberAccountTypeDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty

Source

• Test: tests/ad/group/Test.AD-GMC-03.ps1
• Documentation: tests/ad/group/Test.AD-GMC-03.md