Foreign SID principals count should be investigated
AD-GMC-06InfoActive DirectoryGroups
Part of Active Directory · Active Directory · Groups · All checks
Invoke-Maester -TestId AD-GMC-06Overview
Section titled “Overview”Foreign SIDs represent security identifiers from domains other than the current domain:
- SID History: Migrated accounts may retain original SIDs for access continuity
- Trust Relationships: External domain SIDs indicate trust-based access
- Cross-Forest Access: Forest trusts may introduce SIDs from entirely different forests
- Security Auditing: Foreign SIDs should be tracked as they bypass some local security checks
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Monitor and audit foreign SIDs carefully:
- Review SID history from domain migrations for continued necessity
- Verify that trust relationships with external domains are still required
- Be cautious of foreign SIDs in highly privileged groups
- Document all foreign SID sources for compliance and security reviews
How the Test Works
Section titled “How the Test Works”This test analyzes group membership for foreign SIDs by:
- Comparing member SIDs against the current domain SID
- Identifying SIDs that don’t match the local domain pattern
- Grouping foreign SIDs by their domain of origin
- Counting unique foreign SID principals
For performance reasons, the test analyzes the first 50 groups.
Related Tests
Section titled “Related Tests”Test-MtAdGroupMemberTrustCount- Count of trust members overallTest-MtAdGroupMemberTrustDetails- Detailed view by group
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GMC-06 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Groups |
| Area | External access and sharing |
| Resource type | Group |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdGroupMemberForeignSidCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/group/Test.AD-GMC-06.ps1 - Documentation:
tests/ad/group/Test.AD-GMC-06.md