AD-TRUST-06: Trust stale count should be investigated


ID	`AD-TRUST-06`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Trusts
Security area	External access and sharing
Resource type	Trust
Reads from	On-premises Active Directory

What this checks and how to fix it

Stale trusts (those not validated for extended periods) indicate potential issues:

Decommissioned Domains: The target domain may no longer exist
Connectivity Issues: Network problems preventing trust validation
Orphaned Trusts: Trusts created for temporary purposes that were never removed
Security Hygiene: Unused trusts increase attack surface unnecessarily
Operational Risk: Stale trusts may fail unexpectedly when needed

Trust validation occurs when the trusting domain attempts to verify the trust relationship with the trusted domain. If this hasn’t happened in 60+ days, it suggests the trust is not actively used.

Control Type

Operational

Security Recommendation

Immediate Actions:

Review all stale trusts to determine if they are still needed
Test connectivity to the target domain
Verify the target domain still exists

Remediation Steps:

Verify Need: Confirm if the trust serves a business purpose
Test Connectivity: Attempt to validate the trust manually
Remove if Unused: Delete trusts that are no longer needed
Document Exceptions: For trusts that must remain, document why

Command to Validate a Trust:

Test-ADTrust -Target <TrustName>

Command to Remove a Trust:

Remove-ADTrust -Target <TrustName>

How the Test Works

This test checks the LastValidated property of each trust. Trusts are considered stale if:

LastValidated is not null
LastValidated is more than 60 days in the past

The test returns:

Total trust count
Count of stale trusts
Count of trusts with unknown validation status
Count of valid trusts

Test-MtAdTrustStaleDetails - Lists specific stale trusts with details
Test-MtAdTrustTotalCount - Overall trust count
Test-MtAdTrustDetails - Complete trust configuration including last validated date

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).