# Trust stale count should be investigated

Stale trusts (those not validated for extended periods) indicate potential issues:

Source: https://maester.dev/docs/tests/AD-TRUST-06

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Trusts · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-TRUST-06
```

## Overview

Stale trusts (those not validated for extended periods) indicate potential issues:

- **Decommissioned Domains**: The target domain may no longer exist
- **Connectivity Issues**: Network problems preventing trust validation
- **Orphaned Trusts**: Trusts created for temporary purposes that were never removed
- **Security Hygiene**: Unused trusts increase attack surface unnecessarily
- **Operational Risk**: Stale trusts may fail unexpectedly when needed

Trust validation occurs when the trusting domain attempts to verify the trust relationship with the trusted domain. If this hasn't happened within `MaximumValidationAgeDays` (default 60), it suggests the trust is not actively used.

#### Control Type

**Operational**

#### Security Recommendation

**Immediate Actions:**
- Review all stale trusts to determine if they are still needed
- Test connectivity to the target domain
- Verify the target domain still exists

**Remediation Steps:**
1. **Verify Need**: Confirm if the trust serves a business purpose
2. **Test Connectivity**: Attempt to validate the trust manually
3. **Remove if Unused**: Delete trusts that are no longer needed
4. **Document Exceptions**: For trusts that must remain, document why

**Command to Validate a Trust:**
```powershell
Test-ADTrust -Target <TrustName>
```

**Command to Remove a Trust:**
```powershell
Remove-ADTrust -Target <TrustName>
```

#### How the Test Works

This test checks the `LastValidated` property of each trust. Trusts are considered stale if:
- `LastValidated` is not null
- `LastValidated` is older than `MaximumValidationAgeDays` (default 60)

The test returns:
- Total trust count
- Count of stale trusts
- Count of trusts with unknown validation status
- Count of valid trusts

#### Related Tests

- `Test-MtAdTrustStaleDetails` - Lists specific stale trusts with details
- `Test-MtAdTrustTotalCount` - Overall trust count
- `Test-MtAdTrustDetails` - Complete trust configuration including last validated date

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-TRUST-06 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Trusts |
| Area | External access and sharing |
| Resource type | Trust |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdTrustStaleCount](https://github.com/maester365/maester/blob/main/tests/ad/trust/Test.AD-TRUST-06.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:trustedDomain:ReadProperty |

</details>

## Source

- Test: [`tests/ad/trust/Test.AD-TRUST-06.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/trust/Test.AD-TRUST-06.ps1)
- Documentation: [`tests/ad/trust/Test.AD-TRUST-06.md`](https://github.com/maester365/maester/blob/main/tests/ad/trust/Test.AD-TRUST-06.md)