AD-GRP-03: Stale groups count should be retrievable
| ID | AD-GRP-03 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Groups |
| Security area | Identity lifecycle and hygiene |
| Resource type | Group |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Groups that have not been modified for an extended period (in this case, before 2020) may represent:
- Abandoned groups: Created for projects or purposes that no longer exist
- Orphaned permissions: Groups with memberships that haven’t been reviewed
- Security blind spots: Groups that could be repurposed by attackers
- Directory clutter: Unused objects that complicate administration
- Compliance issues: Undocumented groups that auditors may question
Stale groups pose particular risks because:
- They may contain members who should have been removed
- They might grant access to resources that should be restricted
- Their purpose may be forgotten, making them difficult to audit
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Establish a regular review process for groups that haven’t been modified recently
- Document all groups and their purposes
- Consider implementing a group lifecycle policy with automatic expiration
- Remove groups that are no longer needed after confirming they’re not referenced
- Update the modifyTimeStamp by reviewing group membership periodically
How the Test Works
Section titled “How the Test Works”This test retrieves all group objects from Active Directory and:
- Examines the modifyTimeStamp property of each group
- Counts groups where modifyTimeStamp is before January 1, 2020
- Calculates the percentage of stale groups in the environment
Related Tests
Section titled “Related Tests”Test-MtAdGroupWithManagerCount- Groups with managers are more likely to be actively maintainedTest-MtAdGroupSidHistoryCount- Stale groups may be remnants of domain migrations
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.