User SID History count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Users · All checks

Run this check

Invoke-Maester -TestId AD-USER-13

Overview

SIDHistory is commonly used during migrations so users can retain access to resources secured with legacy SIDs. Long-term SID history can create unnecessary complexity and unintended access paths.

• Migration artifact detection: Identifies users that may still carry legacy identities
• Trust boundary review: Helps spot cross-domain access dependencies
• Permission cleanup: Supports least-privilege remediation after migrations

Control Type

Detective

Security Recommendation

• Review users with SIDHistory to confirm ongoing business need
• Remove unnecessary SID history entries after resource migration is complete
• Pay special attention to SIDs originating from external or less-trusted domains

How the Test Works

This test counts user objects where the SIDHistory attribute contains one or more values.

Related Tests

• Test-MtAdUserNonStandardPrimaryGroupCount - Finds other migration or provisioning anomalies
• Test-MtAdUserAdminCountCount - Helps prioritize review of privileged accounts

Related links

• Microsoft Defender for Identity: Unsecure SID History attributes
• ANSSI Active Directory checkpoints: Accounts or groups with SID history set

Details

Every attribute of this check

Field	Value
Test ID	AD-USER-13
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Users
Area	Identity lifecycle and hygiene
Resource type	User
MITRE ATT&CK	T1134.005 SID-History Injection
PowerShell test	Test-MtAdUserSidHistoryCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:user:ReadProperty

Source

• Test: tests/ad/user/Test.AD-USER-13.ps1
• Documentation: tests/ad/user/Test.AD-USER-13.md