Skip to main content
Version: 2.2.1-preview

AD-TRUST-02 - Trust inter-forest count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Inter-forest trusts (external trusts) connect different Active Directory forests and pose unique security risks:

  • SID History Attacks: External trusts may be vulnerable to SID history attacks where attackers inject privileged SIDs from the external domain
  • Less Visibility: You have less control and visibility over security practices in external forests
  • Lateral Movement: Compromised external domains can be used as pivot points for attacks
  • Trust Transitivity: Understanding which trusts are external helps assess blast radius

Intra-forest trusts (within the same forest) generally have stronger security guarantees because they share a common schema and configuration.

Security Recommendation​

  • Minimize External Trusts: Only create inter-forest trusts when absolutely necessary
  • Enable SID Filtering: Always enable SID filtering (quarantine) on external trusts
  • Selective Authentication: Consider using selective authentication for external trusts
  • Regular Review: Review external trusts quarterly to ensure they are still required
  • Monitor Closely: Enable enhanced logging for authentication events across external trusts
  • Documentation: Maintain detailed documentation of why each external trust exists

How the Test Works​

This test analyzes all trust objects and identifies those where IntraForest is $false. The test returns:

  • Total count of trusts
  • Count of inter-forest trusts
  • Count of intra-forest trusts
  • Test-MtAdTrustQuarantinedCount - Checks if external trusts have SID filtering enabled
  • Test-MtAdTrustNonQuarantinedDetails - Lists external trusts without SID filtering
  • Test-MtAdTrustTotalCount - Overall trust count
  • Test-MtAdTrustDetails - Detailed trust configuration

Test Metadata​

FieldValue
Test IDAD-TRUST-02
SeverityInfo
SuiteActive Directory
CategoryAD.Trust
PowerShell testTest-MtAdTrustInterForestCount
TagsAD, AD-TRUST-02, AD.Trust

Source​

  • Pester test: tests/ad/trust/Test-MtAdTrustInterForestCount.Tests.ps1
  • PowerShell source: powershell/public/ad/trust/Test-MtAdTrustInterForestCount.ps1