# Universal group count should be retrievable

Universal groups play a specific role in multi-domain Active Directory environments:

Source: https://maester.dev/docs/tests/AD-GRP-10

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Groups · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-GRP-10
```

## Overview

Universal groups play a specific role in multi-domain Active Directory environments:

- **Cross-domain flexibility**: Can contain users and groups from any domain in the forest
- **Forest-wide access**: Can be used for access control across the entire forest
- **Global Catalog storage**: Group membership is stored in the Global Catalog
- **Replication impact**: Membership changes trigger forest-wide replication
- **Multi-domain consolidation**: Useful for nesting global groups from multiple domains

High numbers of universal groups may indicate a complex multi-domain environment or potential replication optimization opportunities.

#### Control Type

**Operational**

#### Security Recommendation

Use universal groups strategically:
1. Minimize membership changes to universal groups to reduce replication traffic
2. Use universal groups primarily in multi-domain environments where cross-domain access is needed
3. Nest global groups (containing users) into universal groups rather than adding users directly
4. Consider the replication impact when designing universal group structure
5. Document the forest-wide access each universal group provides
6. In single-domain environments, prefer global and domain local groups

#### How the Test Works

This test examines all group objects and identifies those where:
- The `GroupScope` property equals "Universal"
- These groups can contain members from any domain in the forest
- Membership is stored in the Global Catalog

The test provides counts and percentages to understand the distribution of group scopes in your environment.

#### Related Tests

- `Test-MtAdGroupDistributionCount` - Counts distribution groups (email-only)
- `Test-MtAdGroupSecurityCount` - Counts security groups by category
- `Test-MtAdGroupDomainLocalCount` - Counts domain local scope groups
- `Test-MtAdGroupGlobalCount` - Counts global scope groups

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-GRP-10 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Groups |
| Area | Infrastructure hardening |
| Resource type | Group |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdGroupUniversalCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GRP-10.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:group:ReadProperty |

</details>

## Source

- Test: [`tests/ad/group/Test.AD-GRP-10.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GRP-10.ps1)
- Documentation: [`tests/ad/group/Test.AD-GRP-10.md`](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GRP-10.md)