Skip to content
MitoMito Docs

AD-GRP-09: Global group count should be retrievable
ID AD-GRP-09
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Groups
Security area Infrastructure hardening
Resource type Group
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Global groups are the most commonly used group type for organizing users in Active Directory:

  • User organization: Used to organize users by role, department, or function
  • Forest-wide usage: Can be used across the entire forest for access control
  • Domain replication: Group membership only replicates within the domain, reducing replication traffic
  • AGDLP/AGUDLP strategy: Accounts are placed into Global groups as the first step in the recommended group nesting strategy

A high number of global groups typically indicates well-organized user role management.

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”

Optimize global group usage:

  1. Use global groups to organize users by role, department, or business function
  2. Keep global group membership relatively stable to minimize replication
  3. Nest global groups into domain local or universal groups for resource access
  4. Avoid assigning permissions directly to global groups—use them as user containers
  5. Implement a naming convention that reflects the group’s purpose (e.g., “G-Department-Finance”)

How the Test Works

Section titled “How the Test Works”

This test examines all group objects and identifies those where:

  • The GroupScope property equals “Global”
  • These groups can contain users and other global groups from the same domain
  • Membership changes only replicate within the domain

The test provides counts and percentages to understand the distribution of group scopes in your environment.

Section titled “Related Tests”
  • Test-MtAdGroupDistributionCount - Counts distribution groups (email-only)
  • Test-MtAdGroupSecurityCount - Counts security groups by category
  • Test-MtAdGroupDomainLocalCount - Counts domain local scope groups
  • Test-MtAdGroupUniversalCount - Counts universal scope groups

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.