Trust total count should be investigated
AD-TRUST-01InfoActive DirectoryTrusts
Part of Active Directory · Active Directory · Trusts · All checks
Invoke-Maester -TestId AD-TRUST-01Overview
Section titled “Overview”Domain trusts are critical security boundaries in Active Directory environments. Understanding the number and configuration of trusts is essential for:
- Security Assessment: Knowing how many external entities can authenticate in your environment
- Attack Surface Management: Each trust represents a potential attack vector that needs monitoring
- Compliance Reporting: Many frameworks require documentation of trust relationships
- Operational Visibility: Understanding cross-domain authentication paths
Trusts allow users from one domain to access resources in another. While necessary for multi-domain environments, unnecessary or misconfigured trusts can create security vulnerabilities.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Inventory: Maintain an inventory of all trust relationships and their purposes
- Regular Review: Periodically review trusts to ensure they are still needed
- Documentation: Document the business justification for each trust
- Monitoring: Monitor trust validation status and authentication events
- Principle of Least Privilege: Only create trusts when absolutely necessary
How the Test Works
Section titled “How the Test Works”This test retrieves all trust objects from Active Directory using Get-ADTrust and counts the total number of configured trusts. The test returns:
- Total count of trusts
- Informational result (no pass/fail criteria)
Related Tests
Section titled “Related Tests”Test-MtAdTrustInterForestCount- Identifies external/inter-forest trustsTest-MtAdTrustQuarantinedCount- Checks for SID filtering on trustsTest-MtAdTrustStaleCount- Identifies trusts not validated recentlyTest-MtAdTrustDetails- Provides detailed trust configuration information
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-TRUST-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Trusts |
| Area | External access and sharing |
| Resource type | Trust |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdTrustTotalCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:trustedDomain:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/trust/Test.AD-TRUST-01.ps1 - Documentation:
tests/ad/trust/Test.AD-TRUST-01.md