Stale groups count should be retrievable
AD-GRP-03InfoActive DirectoryGroups
Part of Active Directory · Active Directory · Groups · All checks
Invoke-Maester -TestId AD-GRP-03Overview
Section titled “Overview”Groups that have not been modified for an extended period (in this case, before 2020) may represent:
- Abandoned groups: Created for projects or purposes that no longer exist
- Orphaned permissions: Groups with memberships that haven’t been reviewed
- Security blind spots: Groups that could be repurposed by attackers
- Directory clutter: Unused objects that complicate administration
- Compliance issues: Undocumented groups that auditors may question
Stale groups pose particular risks because:
- They may contain members who should have been removed
- They might grant access to resources that should be restricted
- Their purpose may be forgotten, making them difficult to audit
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Establish a regular review process for groups that haven’t been modified recently
- Document all groups and their purposes
- Consider implementing a group lifecycle policy with automatic expiration
- Remove groups that are no longer needed after confirming they’re not referenced
- Update the modifyTimeStamp by reviewing group membership periodically
How the Test Works
Section titled “How the Test Works”This test retrieves all group objects from Active Directory and:
- Examines the modifyTimeStamp property of each group
- Counts groups where modifyTimeStamp is before January 1, 2020
- Calculates the percentage of stale groups in the environment
Related Tests
Section titled “Related Tests”Test-MtAdGroupWithManagerCount- Groups with managers are more likely to be actively maintainedTest-MtAdGroupSidHistoryCount- Stale groups may be remnants of domain migrations
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GRP-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Groups |
| Area | Identity lifecycle and hygiene |
| Resource type | Group |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdGroupStaleCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:group:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/group/Test.AD-GRP-03.ps1 - Documentation:
tests/ad/group/Test.AD-GRP-03.md