# Trust stale details should be investigated

Trust stale details should be investigated. A Maester check for Active Directory, Trusts.

Source: https://maester.dev/docs/tests/AD-TRUST-07

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Trusts · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-TRUST-07
```

## Overview

Identifying specific stale trusts enables targeted remediation:

- **Prioritization**: Focus cleanup efforts on the oldest, most likely unused trusts
- **Investigation**: Specific target domains can be investigated for existence and need
- **Risk Assessment**: Older trusts may represent higher security risks
- **Documentation**: Detailed stale trust information supports decision-making
- **Compliance**: Demonstrates active trust management for audits

Stale trusts often accumulate over time as:
- Temporary project trusts are forgotten
- Acquired company domains are decommissioned
- Network restructuring leaves orphaned connections
- Test environments are removed without cleanup

#### Control Type

**Operational**

#### Security Recommendation

**Investigation Process:**

1. **Identify Target Domain**: Determine if the target domain still exists
2. **Check Business Need**: Verify if any systems still require the trust
3. **Test Validation**: Attempt manual trust validation
4. **Plan Removal**: Schedule removal if trust is confirmed unused
5. **Document**: Record removal rationale for audit purposes

**Sample Investigation Commands:**
```powershell
#### Test if the trust can be validated
Test-ADTrust -Target <TrustName>

#### Check when the trust was created
Get-ADTrust -Filter {Target -eq "<TrustName>"} -Properties Created

#### View detailed trust information
Get-ADTrust -Filter {Target -eq "<TrustName>"} -Properties *
```

**Removal Process:**
- Notify stakeholders before removing production trusts
- Remove during maintenance windows
- Document removal in change management system
- Monitor for any authentication failures after removal

#### How the Test Works

This test identifies trusts where `LastValidated` is older than `StaleThresholdDays` (default 60) and displays:

- Target domain name
- Trust direction
- Last validation date
- Days since last validation
- Trust type

Results are sorted by last validation date (oldest first).

#### Related Tests

- `Test-MtAdTrustStaleCount` - Count of stale trusts
- `Test-MtAdTrustTotalCount` - Overall trust count
- `Test-MtAdTrustDetails` - Complete trust configuration information

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-TRUST-07 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Trusts |
| Area | External access and sharing |
| Resource type | Trust |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdTrustStaleDetails](https://github.com/maester365/maester/blob/main/tests/ad/trust/Test.AD-TRUST-07.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:trustedDomain:ReadProperty |

</details>

## Source

- Test: [`tests/ad/trust/Test.AD-TRUST-07.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/trust/Test.AD-TRUST-07.ps1)
- Documentation: [`tests/ad/trust/Test.AD-TRUST-07.md`](https://github.com/maester365/maester/blob/main/tests/ad/trust/Test.AD-TRUST-07.md)