Global group count should be retrievable
AD-GRP-09InfoActive DirectoryGroups
Part of Active Directory · Active Directory · Groups · All checks
Invoke-Maester -TestId AD-GRP-09Overview
Section titled “Overview”Global groups are the most commonly used group type for organizing users in Active Directory:
- User organization: Used to organize users by role, department, or function
- Forest-wide usage: Can be used across the entire forest for access control
- Domain replication: Group membership only replicates within the domain, reducing replication traffic
- AGDLP/AGUDLP strategy: Accounts are placed into Global groups as the first step in the recommended group nesting strategy
A high number of global groups typically indicates well-organized user role management.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Optimize global group usage:
- Use global groups to organize users by role, department, or business function
- Keep global group membership relatively stable to minimize replication
- Nest global groups into domain local or universal groups for resource access
- Avoid assigning permissions directly to global groups—use them as user containers
- Implement a naming convention that reflects the group’s purpose (e.g., “G-Department-Finance”)
How the Test Works
Section titled “How the Test Works”This test examines all group objects and identifies those where:
- The
GroupScopeproperty equals “Global” - These groups can contain users and other global groups from the same domain
- Membership changes only replicate within the domain
The test provides counts and percentages to understand the distribution of group scopes in your environment.
Related Tests
Section titled “Related Tests”Test-MtAdGroupDistributionCount- Counts distribution groups (email-only)Test-MtAdGroupSecurityCount- Counts security groups by categoryTest-MtAdGroupDomainLocalCount- Counts domain local scope groupsTest-MtAdGroupUniversalCount- Counts universal scope groups
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GRP-09 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Groups |
| Area | Infrastructure hardening |
| Resource type | Group |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdGroupGlobalCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:group:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/group/Test.AD-GRP-09.ps1 - Documentation:
tests/ad/group/Test.AD-GRP-09.md