Empty non-privileged group count should be investigated
AD-GMC-08InfoActive DirectoryGroups
Part of Active Directory · Active Directory · Groups · All checks
Invoke-Maester -TestId AD-GMC-08Overview
Section titled “Overview”Empty groups that are not privileged (no adminCount) represent directory clutter that should be addressed:
- Directory hygiene: Unused groups create noise and confusion in access management
- Audit complexity: Empty groups increase the surface area for security audits
- Change tracking: Groups created for temporary purposes but never cleaned up
- Operational efficiency: Simplifies group management and reduces confusion
- Potential risks: Empty groups could be populated unexpectedly
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Implement a regular cleanup process:
- Review empty non-privileged groups quarterly
- Establish group lifecycle policies (creation, usage, retirement)
- Document exceptions for empty groups that must be preserved
- Consider automated cleanup for groups empty for extended periods
- Maintain an exceptions list for groups required by applications
How the Test Works
Section titled “How the Test Works”This test iterates through all Active Directory groups, checks their membership count, and identifies groups that:
- Have no members
- Do not have adminCount = 1 (not privileged groups protected by AdminSDHolder)
The test categorizes groups by their status (empty privileged, empty non-privileged, with members).
Related Tests
Section titled “Related Tests”Test-MtAdGroupEmptyNonPrivilegedDetails- Lists specific empty non-privileged groupsTest-MtAdGroupPrivilegedWithMembersCount- Reviews privileged groups with members
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GMC-08 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Groups |
| Area | Identity lifecycle and hygiene |
| Resource type | Group |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdGroupEmptyNonPrivilegedCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/group/Test.AD-GMC-08.ps1 - Documentation:
tests/ad/group/Test.AD-GMC-08.md