Skip to main content
Version: 2.2.1-preview

AD-GMC-06 - Foreign SID principals count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Foreign SIDs represent security identifiers from domains other than the current domain:

  • SID History: Migrated accounts may retain original SIDs for access continuity
  • Trust Relationships: External domain SIDs indicate trust-based access
  • Cross-Forest Access: Forest trusts may introduce SIDs from entirely different forests
  • Security Auditing: Foreign SIDs should be tracked as they bypass some local security checks

Security Recommendation​

Monitor and audit foreign SIDs carefully:

  • Review SID history from domain migrations for continued necessity
  • Verify that trust relationships with external domains are still required
  • Be cautious of foreign SIDs in highly privileged groups
  • Document all foreign SID sources for compliance and security reviews

How the Test Works​

This test analyzes group membership for foreign SIDs by:

  • Comparing member SIDs against the current domain SID
  • Identifying SIDs that don't match the local domain pattern
  • Grouping foreign SIDs by their domain of origin
  • Counting unique foreign SID principals

For performance reasons, the test analyzes the first 50 groups.

  • Test-MtAdGroupMemberTrustCount - Count of trust members overall
  • Test-MtAdGroupMemberTrustDetails - Detailed view by group

Test Metadata​

FieldValue
Test IDAD-GMC-06
SeverityInfo
SuiteActive Directory
CategoryAD.Group
PowerShell testTest-MtAdGroupMemberForeignSidCount
TagsAD, AD-GMC-06, AD.Group

Source​

  • Pester test: tests/ad/group/Test-MtAdGroupMemberForeignSidCount.Tests.ps1
  • PowerShell source: powershell/public/ad/group/Test-MtAdGroupMemberForeignSidCount.ps1