Trust configuration details should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Trusts · All checks

Run this check

Invoke-Maester -TestId AD-TRUST-05

Overview

Comprehensive trust documentation is essential for security operations:

• Security Audits: Auditors require detailed trust configuration information
• Incident Response: Understanding trust relationships helps during security incidents
• Change Management: Tracking trust configurations supports change control processes
• Risk Assessment: Detailed trust information enables proper risk evaluation
• Compliance: Many frameworks require documentation of trust relationships

Trust details reveal critical security properties including:

• Direction: Who can access whose resources
• Type: External vs Forest trust (different security models)
• SID Filtering: Whether the trust has strong SID filtering
• Selective Authentication: Whether authentication is restricted
• Trust Classification: Derived IsForest, IsExternal, and SidFilteringWeak properties

Control Type

Operational

Security Recommendation

Configuration Best Practices:

1. Use Forest Trusts: Prefer forest trusts over external trusts for better security
2. Enable SID Filtering: Always enable SID filtering on external trusts
3. Selective Authentication: Use selective authentication when possible
4. Inbound Only: Prefer inbound trusts over bidirectional when possible
5. Document Everything: Maintain detailed documentation of each trust’s purpose

Trust Properties to Monitor:

• Quarantined: Should be $true for external trusts (SID filtering enabled)
• SidFilteringWeak: Should be $false for both external and forest trusts
• SelectiveAuthentication: Consider enabling for sensitive environments
• Direction: Bidirectional trusts have higher risk
• IsForest / IsExternal: Helps identify which SID filtering rules apply

How the Test Works

This test retrieves all trust properties from LDAP and derives display values:

• Quarantined: Derived from trustAttributes bit 0x4 (QUARANTINED_DOMAIN)
• Selective Authentication: Derived from trustAttributes bit 0x10 (CROSS_ORGANIZATION)
• Intra-Forest: Derived from trustAttributes bit 0x20 (WITHIN_FOREST)
• IsForest: Derived from trustAttributes bit 0x8 (FOREST_TRANSITIVE)
• IsExternal: Derived from trustType in 1,2 and absence of FOREST_TRANSITIVE / WITHIN_FOREST
• SidFilteringWeak: External trusts weak when QUARANTINED_DOMAIN not set; forest trusts weak when TREAT_AS_EXTERNAL (0x40) is set
• Trust Type: Mapped from numeric trustType (1=External Downlevel, 2=Domain Uplevel, 3=MIT Kerberos, 4=DCE)
• Direction: Mapped from numeric trustDirection (1=Inbound, 2=Outbound, 3=Bidirectional)

Related Tests

• Test-MtAdTrustTotalCount - Overall trust count
• Test-MtAdTrustInterForestCount - External trust identification
• Test-MtAdTrustQuarantinedCount - SID filtering status
• Test-MtAdTrustStaleCount - Trust validation status

Details

Every attribute of this check

Field	Value
Test ID	AD-TRUST-05
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Trusts
Area	External access and sharing
Resource type	Trust
MITRE ATT&CK	None
PowerShell test	Test-MtAdTrustDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:trustedDomain:ReadProperty

Source

• Test: tests/ad/trust/Test.AD-TRUST-05.ps1
• Documentation: tests/ad/trust/Test.AD-TRUST-05.md