Skip to main content
Version: 2.2.1-preview

AD-GMC-08 - Empty non-privileged group count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Empty groups that are not privileged (no adminCount) represent directory clutter that should be addressed:

  • Directory hygiene: Unused groups create noise and confusion in access management
  • Audit complexity: Empty groups increase the surface area for security audits
  • Change tracking: Groups created for temporary purposes but never cleaned up
  • Operational efficiency: Simplifies group management and reduces confusion
  • Potential risks: Empty groups could be populated unexpectedly

Security Recommendation​

Implement a regular cleanup process:

  • Review empty non-privileged groups quarterly
  • Establish group lifecycle policies (creation, usage, retirement)
  • Document exceptions for empty groups that must be preserved
  • Consider automated cleanup for groups empty for extended periods
  • Maintain an exceptions list for groups required by applications

How the Test Works​

This test iterates through all Active Directory groups, checks their membership count, and identifies groups that:

  1. Have no members
  2. Do not have adminCount = 1 (not privileged groups protected by AdminSDHolder)

The test categorizes groups by their status (empty privileged, empty non-privileged, with members).

  • Test-MtAdGroupEmptyNonPrivilegedDetails - Lists specific empty non-privileged groups
  • Test-MtAdGroupPrivilegedWithMembersCount - Reviews privileged groups with members

Test Metadata​

FieldValue
Test IDAD-GMC-08
SeverityInfo
SuiteActive Directory
CategoryAD.Group
PowerShell testTest-MtAdGroupEmptyNonPrivilegedCount
TagsAD, AD-GMC-08, AD.GMC, AD.Group

Source​

  • Pester test: tests/ad/group/Test-MtAdGroupEmptyNonPrivilegedCount.Tests.ps1
  • PowerShell source: powershell/public/ad/group/Test-MtAdGroupEmptyNonPrivilegedCount.ps1