AD-USER-12: User non-standard primary group count should be retrievable
| ID | AD-USER-12 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Identity lifecycle and hygiene |
| Resource type | User |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Most user accounts use PrimaryGroupId = 513, which corresponds to Domain Users. When a user has a different primary group, the configuration is often intentional but uncommon.
- Privilege review: Non-standard primary groups can indicate elevated or specialized access models
- Migration residue: Legacy migrations and scripted provisioning may leave unusual values behind
- Access clarity: Atypical primary groups make account analysis more complex
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Review users whose
PrimaryGroupIdis not513 - Confirm the configuration is required and documented
- Standardize primary groups where there is no operational reason for deviation
How the Test Works
Section titled “How the Test Works”This test counts user objects where primaryGroupId is populated and not equal to 513.
Related Tests
Section titled “Related Tests”Test-MtAdUserAdminCountCount- Highlights protected or privileged accountsTest-MtAdUserSidHistoryCount- Identifies migration-related account artifacts
Related links
Section titled “Related links”- Microsoft Defender for Identity: Accounts with non-default Primary Group ID
- ANSSI Active Directory checkpoints: Accounts with modified PrimaryGroupID
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.