AD-GRP-01: Group AdminCount should be retrievable


ID	`AD-GRP-01`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Groups
Security area	Privileged access
Resource type	Group
Reads from	On-premises Active Directory

What this checks and how to fix it

The AdminCount attribute is a critical Active Directory security marker that indicates a group is considered “protected” by the system. Groups with AdminCount set receive special security protections that prevent delegation of administrative privileges through inheritance. This test helps identify:

Privileged groups: Groups that are members of protected groups like Domain Admins, Enterprise Admins, or Schema Admins
Security inheritance issues: Groups that may have broken inheritance due to AdminCount settings
Audit targets: Groups requiring enhanced monitoring due to their administrative nature
Delegation challenges: Groups that cannot receive permissions through normal inheritance

Control Type

Detective

Security Recommendation

Review all groups with AdminCount set to ensure they still require elevated privileges
Remove groups from protected groups if they no longer need administrative access
Be aware that removing a group from a protected group does not automatically clear the AdminCount attribute
Manually clear AdminCount for groups that should no longer be protected
Monitor changes to AdminCount attributes as they indicate privilege escalation

How the Test Works

This test retrieves all group objects from Active Directory and counts:

Total number of groups
Number of groups with AdminCount attribute set (non-null and greater than 0)
Percentage of groups with AdminCount

Test-MtAdGroupWithManagerCount - Identifies groups with delegated management
Test-MtAdGroupSidHistoryCount - Finds groups migrated from other domains

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).