AD-COMP-05: Computer SID History count should be retrievable


ID	`AD-COMP-05`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Computers
Security area	Identity lifecycle and hygiene
Resource type	Computer
MITRE ATT&CK	T1134.005
Reads from	On-premises Active Directory

What this checks and how to fix it

SID History is an attribute used during domain migrations to maintain access to resources in the source domain. While necessary during migrations, persistent SID History on computer accounts can indicate:

Incomplete migrations: Computers that were migrated but never fully transitioned
Security risks: SIDs from untrusted or less-secure domains may grant unintended access
Directory bloat: Unnecessary data in the directory that complicates troubleshooting
Audit complexity: Makes it harder to determine effective permissions

Control Type

Detective

Security Recommendation

Review computers with SID History to determine if the migration is complete
Remove SID History attributes once systems are fully migrated and resource access is verified
Be cautious of SID History containing SIDs from external or untrusted domains
Document any computers that legitimately require long-term SID History

How the Test Works

This test counts computer objects where the SIDHistory attribute is populated. This attribute typically contains one or more SIDs from the computer’s previous domain(s).

Test-MtAdComputerNonStandardGroup - Identifies other migration or configuration anomalies
Test-MtAdComputerDormantCount - Finds stale accounts that may be migration remnants

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).