Skip to content
MitoMito Docs

AD-TRUST-01: Trust total count should be investigated
ID AD-TRUST-01
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Trusts
Security area External access and sharing
Resource type Trust
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Domain trusts are critical security boundaries in Active Directory environments. Understanding the number and configuration of trusts is essential for:

  • Security Assessment: Knowing how many external entities can authenticate in your environment
  • Attack Surface Management: Each trust represents a potential attack vector that needs monitoring
  • Compliance Reporting: Many frameworks require documentation of trust relationships
  • Operational Visibility: Understanding cross-domain authentication paths

Trusts allow users from one domain to access resources in another. While necessary for multi-domain environments, unnecessary or misconfigured trusts can create security vulnerabilities.

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”
  • Inventory: Maintain an inventory of all trust relationships and their purposes
  • Regular Review: Periodically review trusts to ensure they are still needed
  • Documentation: Document the business justification for each trust
  • Monitoring: Monitor trust validation status and authentication events
  • Principle of Least Privilege: Only create trusts when absolutely necessary

How the Test Works

Section titled “How the Test Works”

This test retrieves all trust objects from Active Directory using Get-ADTrust and counts the total number of configured trusts. The test returns:

  • Total count of trusts
  • Informational result (no pass/fail criteria)
Section titled “Related Tests”
  • Test-MtAdTrustInterForestCount - Identifies external/inter-forest trusts
  • Test-MtAdTrustQuarantinedCount - Checks for SID filtering on trusts
  • Test-MtAdTrustStaleCount - Identifies trusts not validated recently
  • Test-MtAdTrustDetails - Provides detailed trust configuration information

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.