Distribution group count should be retrievable
AD-GRP-06InfoActive DirectoryGroups
Part of Active Directory · Active Directory · Groups · All checks
Invoke-Maester -TestId AD-GRP-06Overview
Section titled “Overview”Distribution groups are email-only groups used for Exchange and email distribution lists. Understanding their count and proportion helps:
- Email infrastructure assessment: Provides visibility into the email distribution infrastructure
- Security boundary awareness: Distinguishes email-only groups from security groups that control access
- Exchange management: Helps assess Exchange/Exchange Online integration and email distribution complexity
- Migration planning: Useful when planning migrations to Exchange Online or other email systems
Distribution groups cannot be used for access control—they are purely for email functionality.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Regularly review distribution groups to:
- Identify and remove stale or unused distribution lists
- Ensure sensitive distribution groups have appropriate ownership
- Verify that distribution groups are not being used inappropriately for security purposes
- Consider converting distribution groups to Office 365 Groups where appropriate for modern collaboration
How the Test Works
Section titled “How the Test Works”This test examines all group objects and identifies those where:
- The
GroupCategoryproperty equals “Distribution” - These groups are used solely for email distribution, not access control
The test provides counts and percentages to understand the distribution of group types in your environment.
Related Tests
Section titled “Related Tests”Test-MtAdGroupSecurityCount- Counts security groups used for access controlTest-MtAdGroupDomainLocalCount- Counts domain local scope groupsTest-MtAdGroupGlobalCount- Counts global scope groupsTest-MtAdGroupUniversalCount- Counts universal scope groups
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GRP-06 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Groups |
| Area | Infrastructure hardening |
| Resource type | Group |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdGroupDistributionCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:group:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/group/Test.AD-GRP-06.ps1 - Documentation:
tests/ad/group/Test.AD-GRP-06.md