Group AdminCount should be retrievable
AD-GRP-01InfoActive DirectoryGroups
Part of Active Directory · Active Directory · Groups · All checks
Invoke-Maester -TestId AD-GRP-01Overview
Section titled “Overview”The AdminCount attribute is a critical Active Directory security marker that indicates a group is considered “protected” by the system. Groups with AdminCount set receive special security protections that prevent delegation of administrative privileges through inheritance. This test helps identify:
- Privileged groups: Groups that are members of protected groups like Domain Admins, Enterprise Admins, or Schema Admins
- Security inheritance issues: Groups that may have broken inheritance due to AdminCount settings
- Audit targets: Groups requiring enhanced monitoring due to their administrative nature
- Delegation challenges: Groups that cannot receive permissions through normal inheritance
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Review all groups with AdminCount set to ensure they still require elevated privileges
- Remove groups from protected groups if they no longer need administrative access
- Be aware that removing a group from a protected group does not automatically clear the AdminCount attribute
- Manually clear AdminCount for groups that should no longer be protected
- Monitor changes to AdminCount attributes as they indicate privilege escalation
How the Test Works
Section titled “How the Test Works”This test retrieves all group objects from Active Directory and counts:
- Total number of groups
- Number of groups with AdminCount attribute set (non-null and greater than 0)
- Percentage of groups with AdminCount
Related Tests
Section titled “Related Tests”Test-MtAdGroupWithManagerCount- Identifies groups with delegated managementTest-MtAdGroupSidHistoryCount- Finds groups migrated from other domains
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GRP-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Groups |
| Area | Privileged access |
| Resource type | Group |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdGroupAdminCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:group:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/group/Test.AD-GRP-01.ps1 - Documentation:
tests/ad/group/Test.AD-GRP-01.md