Skip to content
MitoMito Docs

AD-GRP-06: Distribution group count should be retrievable
ID AD-GRP-06
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Groups
Security area Infrastructure hardening
Resource type Group
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Distribution groups are email-only groups used for Exchange and email distribution lists. Understanding their count and proportion helps:

  • Email infrastructure assessment: Provides visibility into the email distribution infrastructure
  • Security boundary awareness: Distinguishes email-only groups from security groups that control access
  • Exchange management: Helps assess Exchange/Exchange Online integration and email distribution complexity
  • Migration planning: Useful when planning migrations to Exchange Online or other email systems

Distribution groups cannot be used for access control—they are purely for email functionality.

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”

Regularly review distribution groups to:

  1. Identify and remove stale or unused distribution lists
  2. Ensure sensitive distribution groups have appropriate ownership
  3. Verify that distribution groups are not being used inappropriately for security purposes
  4. Consider converting distribution groups to Office 365 Groups where appropriate for modern collaboration

How the Test Works

Section titled “How the Test Works”

This test examines all group objects and identifies those where:

  • The GroupCategory property equals “Distribution”
  • These groups are used solely for email distribution, not access control

The test provides counts and percentages to understand the distribution of group types in your environment.

Section titled “Related Tests”
  • Test-MtAdGroupSecurityCount - Counts security groups used for access control
  • Test-MtAdGroupDomainLocalCount - Counts domain local scope groups
  • Test-MtAdGroupGlobalCount - Counts global scope groups
  • Test-MtAdGroupUniversalCount - Counts universal scope groups

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.