Version: 2.2.1-preview

AD-GRP-09 - Global group count should be retrievable

Overview

Global groups are the most commonly used group type for organizing users in Active Directory:

User organization: Used to organize users by role, department, or function
Forest-wide usage: Can be used across the entire forest for access control
Domain replication: Group membership only replicates within the domain, reducing replication traffic
AGDLP/AGUDLP strategy: Accounts are placed into Global groups as the first step in the recommended group nesting strategy

A high number of global groups typically indicates well-organized user role management.

Optimize global group usage:

Use global groups to organize users by role, department, or business function
Keep global group membership relatively stable to minimize replication
Nest global groups into domain local or universal groups for resource access
Avoid assigning permissions directly to global groups—use them as user containers
Implement a naming convention that reflects the group's purpose (e.g., "G-Department-Finance")

This test examines all group objects and identifies those where:

The test provides counts and percentages to understand the distribution of group scopes in your environment.