# Computer SID History count should be retrievable

SID History is an attribute used during domain migrations to maintain access to resources in the source domain.

Source: https://maester.dev/docs/tests/AD-COMP-05

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Computers · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-COMP-05
```

## Overview

SID History is an attribute used during domain migrations to maintain access to resources in the source domain. While necessary during migrations, persistent SID History on computer accounts can indicate:

- **Incomplete migrations**: Computers that were migrated but never fully transitioned
- **Security risks**: SIDs from untrusted or less-secure domains may grant unintended access
- **Directory bloat**: Unnecessary data in the directory that complicates troubleshooting
- **Audit complexity**: Makes it harder to determine effective permissions

#### Control Type

**Detective**

#### Security Recommendation

- Review computers with SID History to determine if the migration is complete
- Remove SID History attributes once systems are fully migrated and resource access is verified
- Be cautious of SID History containing SIDs from external or untrusted domains
- Document any computers that legitimately require long-term SID History

#### How the Test Works

This test counts computer objects where the `SIDHistory` attribute is populated. This attribute typically contains one or more SIDs from the computer's previous domain(s).

#### Related Tests

- `Test-MtAdComputerNonStandardGroup` - Identifies other migration or configuration anomalies
- `Test-MtAdComputerDormantCount` - Finds stale accounts that may be migration remnants

#### Related links

- [Microsoft Defender for Identity: Unsecure SID History attributes](https://learn.microsoft.com/defender-for-identity/security-posture-assessments/accounts#unsecure-sid-history-attributes)
- [ANSSI Active Directory checkpoints: Accounts or groups with SID history set](https://www.cert.ssi.gouv.fr/uploads/ad_checklist.html#vuln_sidhistory_present)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-COMP-05 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Computers |
| Area | Identity lifecycle and hygiene |
| Resource type | Computer |
| MITRE ATT&CK | T1134.005 SID-History Injection |
| PowerShell test | [Test-MtAdComputerSidHistoryCount](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-05.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |

</details>

## Source

- Test: [`tests/ad/computer/Test.AD-COMP-05.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-05.ps1)
- Documentation: [`tests/ad/computer/Test.AD-COMP-05.md`](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-05.md)