Privileged groups with members details should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Groups · All checks

Run this check

Invoke-Maester -TestId AD-GMC-11

Overview

Understanding which privileged accounts have access is fundamental to Active Directory security:

• Identity management: Know who has administrative access
• Over-privilege detection: Identify accounts with excessive permissions
• Attack path analysis: Understand potential lateral movement routes
• Compliance evidence: Document privileged access for audits
• Access certification: Support periodic access reviews

Well-known privileged groups:

• Domain Admins (RID 512): Full administrative control of the domain
• Enterprise Admins (RID 519): Full administrative control of the forest
• Schema Admins (RID 518): Can modify Active Directory schema
• Account Operators (RID 548): Can manage user and group accounts
• Server Operators (RID 549): Can manage domain servers
• Print Operators (RID 550): Can manage print services
• Backup Operators (RID 551): Can bypass file security for backup

Control Type

Operational

Security Recommendation

Review privileged group membership regularly:

• Document all members and their justifications
• Remove stale or unnecessary memberships
• Verify service accounts aren’t in privileged groups unnecessarily
• Consider implementing privileged access management (PAM) solutions
• Use separate administrative accounts for privileged activities
• Implement time-bound access for privileged roles
• Monitor for new privileged group additions

How the Test Works

This test lists all privileged groups (those with adminCount = 1 or well-known RIDs) and provides:

• Group name and RID
• Member count for each group
• Categorization by well-known vs. AdminSDHolder protected groups
• Total members across all privileged groups

Related Tests

• Test-MtAdGroupPrivilegedWithMembersCount - Counts privileged groups with members
• Test-MtAdGroupMemberForeignSidDetails - Reviews foreign security principals in groups

Details

Every attribute of this check

Field	Value
Test ID	AD-GMC-11
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Groups
Area	Privileged access
Resource type	Group
MITRE ATT&CK	T1098.007 Additional Local or Domain Groups, T1078.002 Domain Accounts
PowerShell test	Test-MtAdGroupPrivilegedWithMembersDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty

Source

• Test: tests/ad/group/Test.AD-GMC-11.ps1
• Documentation: tests/ad/group/Test.AD-GMC-11.md