Skip to main content
Version: 2.2.1-preview

AD-GMC-05 - Trust members details by group should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Understanding which specific groups contain trust members is critical for security management:

  • Privileged Access: Trust members in privileged groups (Administrators, Domain Admins) represent significant risk
  • Access Path Analysis: Knowing which groups contain external members helps trace access paths
  • Trust Management: Groups with many trust members may indicate over-reliance on external access
  • Compliance: Some compliance frameworks require documentation of cross-domain access

Security Recommendation​

Perform detailed review of groups containing trust members:

  • Prioritize review of privileged groups with external members
  • Document the source domain and purpose of each trust member
  • Establish processes to periodically validate continued need for external access
  • Consider creating domain-local groups specifically for external access to maintain clear boundaries

How the Test Works​

This test provides detailed analysis of trust membership:

  • Identifies which groups contain trust members
  • Lists trust members per group with their SIDs and types
  • Shows the distribution of external access across groups

For performance reasons, the test analyzes the first 50 groups and limits display to 10 members per group.

  • Test-MtAdGroupMemberTrustCount - Overall count of trust members
  • Test-MtAdGroupMemberForeignSidCount - Analysis of foreign SIDs

Test Metadata​

FieldValue
Test IDAD-GMC-05
SeverityInfo
SuiteActive Directory
CategoryAD.Group
PowerShell testTest-MtAdGroupMemberTrustDetails
TagsAD, AD-GMC-05, AD.Group

Source​

  • Pester test: tests/ad/group/Test-MtAdGroupMemberTrustDetails.Tests.ps1
  • PowerShell source: powershell/public/ad/group/Test-MtAdGroupMemberTrustDetails.ps1