User non-standard primary group count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Users · All checks

Run this check

Invoke-Maester -TestId AD-USER-12

Overview

Most user accounts use PrimaryGroupId = 513, which corresponds to Domain Users. When a user has a different primary group, the configuration is often intentional but uncommon.

• Privilege review: Non-standard primary groups can indicate elevated or specialized access models
• Migration residue: Legacy migrations and scripted provisioning may leave unusual values behind
• Access clarity: Atypical primary groups make account analysis more complex

Control Type

Detective

Security Recommendation

• Review users whose PrimaryGroupId is not 513
• Confirm the configuration is required and documented
• Standardize primary groups where there is no operational reason for deviation

How the Test Works

This test counts user objects where primaryGroupId is populated and not equal to 513.

Related Tests

• Test-MtAdUserAdminCountCount - Highlights protected or privileged accounts
• Test-MtAdUserSidHistoryCount - Identifies migration-related account artifacts

Related links

• Microsoft Defender for Identity: Accounts with non-default Primary Group ID
• ANSSI Active Directory checkpoints: Accounts with modified PrimaryGroupID

Details

Every attribute of this check

Field	Value
Test ID	AD-USER-12
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Users
Area	Identity lifecycle and hygiene
Resource type	User
MITRE ATT&CK	None
PowerShell test	Test-MtAdUserNonStandardPrimaryGroupCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:user:ReadProperty

Source

• Test: tests/ad/user/Test.AD-USER-12.ps1
• Documentation: tests/ad/user/Test.AD-USER-12.md