Domain local group count should be retrievable
AD-GRP-08InfoActive DirectoryGroups
Part of Active Directory · Active Directory · Groups · All checks
Invoke-Maester -TestId AD-GRP-08Overview
Section titled “Overview”Domain local groups have specific characteristics that affect your security architecture:
- Domain boundary restriction: Can only be used to assign permissions to resources within the same domain
- Flexible membership: Can contain users, global groups, and universal groups from any domain in the forest
- Resource access control: Typically used to grant access to specific resources (file shares, printers, applications)
- AGDLP/AGUDLP strategy: Part of Microsoft’s recommended group nesting strategy (Accounts go into Global groups, which go into Domain Local groups for Permissions)
High numbers of domain local groups may indicate resource-specific access patterns.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Follow Microsoft’s AGDLP/AGUDLP best practices:
- Use domain local groups to assign permissions to resources in their domain
- Nest global or universal groups (containing users) into domain local groups
- Avoid adding individual users directly to domain local groups
- Name domain local groups according to their resource access purpose (e.g., “DL-FileServer01-Modify”)
- Document all resources each domain local group provides access to
How the Test Works
Section titled “How the Test Works”This test examines all group objects and identifies those where:
- The
GroupScopeproperty equals “DomainLocal” - These groups can only assign permissions to resources in their own domain
The test provides counts and percentages to understand the distribution of group scopes in your environment.
Related Tests
Section titled “Related Tests”Test-MtAdGroupDistributionCount- Counts distribution groups (email-only)Test-MtAdGroupSecurityCount- Counts security groups by categoryTest-MtAdGroupGlobalCount- Counts global scope groupsTest-MtAdGroupUniversalCount- Counts universal scope groups
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GRP-08 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Groups |
| Area | Infrastructure hardening |
| Resource type | Group |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdGroupDomainLocalCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:group:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/group/Test.AD-GRP-08.ps1 - Documentation:
tests/ad/group/Test.AD-GRP-08.md