AD-TRUST-02: Trust inter-forest count should be investigated
| ID | AD-TRUST-02 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Trusts |
| Security area | External access and sharing |
| Resource type | Trust |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Inter-forest trusts (external trusts) connect different Active Directory forests and pose unique security risks:
- SID History Attacks: External trusts may be vulnerable to SID history attacks where attackers inject privileged SIDs from the external domain
- Less Visibility: You have less control and visibility over security practices in external forests
- Lateral Movement: Compromised external domains can be used as pivot points for attacks
- Trust Transitivity: Understanding which trusts are external helps assess blast radius
Intra-forest trusts (within the same forest) generally have stronger security guarantees because they share a common schema and configuration.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Minimize External Trusts: Only create inter-forest trusts when absolutely necessary
- Enable SID Filtering: Always enable SID filtering (quarantine) on external trusts
- Selective Authentication: Consider using selective authentication for external trusts
- Regular Review: Review external trusts quarterly to ensure they are still required
- Monitor Closely: Enable enhanced logging for authentication events across external trusts
- Documentation: Maintain detailed documentation of why each external trust exists
How the Test Works
Section titled “How the Test Works”This test analyzes all trust objects and identifies those where IntraForest is $false. The test returns:
- Total count of trusts
- Count of inter-forest trusts
- Count of intra-forest trusts
Related Tests
Section titled “Related Tests”Test-MtAdTrustQuarantinedCount- Checks if external trusts have SID filtering enabledTest-MtAdTrustNonQuarantinedDetails- Lists external trusts without SID filteringTest-MtAdTrustTotalCount- Overall trust countTest-MtAdTrustDetails- Detailed trust configuration
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.