Trust members details by group should be investigated
AD-GMC-05InfoActive DirectoryGroups
Part of Active Directory · Active Directory · Groups · All checks
Invoke-Maester -TestId AD-GMC-05Overview
Section titled “Overview”Understanding which specific groups contain trust members is critical for security management:
- Privileged Access: Trust members in privileged groups (Administrators, Domain Admins) represent significant risk
- Access Path Analysis: Knowing which groups contain external members helps trace access paths
- Trust Management: Groups with many trust members may indicate over-reliance on external access
- Compliance: Some compliance frameworks require documentation of cross-domain access
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Perform detailed review of groups containing trust members:
- Prioritize review of privileged groups with external members
- Document the source domain and purpose of each trust member
- Establish processes to periodically validate continued need for external access
- Consider creating domain-local groups specifically for external access to maintain clear boundaries
How the Test Works
Section titled “How the Test Works”This test provides detailed analysis of trust membership:
- Identifies which groups contain trust members
- Lists trust members per group with their SIDs and types
- Shows the distribution of external access across groups
For performance reasons, the test analyzes the first 50 groups and limits display to 10 members per group.
Related Tests
Section titled “Related Tests”Test-MtAdGroupMemberTrustCount- Overall count of trust membersTest-MtAdGroupMemberForeignSidCount- Analysis of foreign SIDs
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GMC-05 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Groups |
| Area | External access and sharing |
| Resource type | Group |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdGroupMemberTrustDetails |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/group/Test.AD-GMC-05.ps1 - Documentation:
tests/ad/group/Test.AD-GMC-05.md