AD-GRP-08: Domain local group count should be retrievable
| ID | AD-GRP-08 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Groups |
| Security area | Infrastructure hardening |
| Resource type | Group |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Domain local groups have specific characteristics that affect your security architecture:
- Domain boundary restriction: Can only be used to assign permissions to resources within the same domain
- Flexible membership: Can contain users, global groups, and universal groups from any domain in the forest
- Resource access control: Typically used to grant access to specific resources (file shares, printers, applications)
- AGDLP/AGUDLP strategy: Part of Microsoft’s recommended group nesting strategy (Accounts go into Global groups, which go into Domain Local groups for Permissions)
High numbers of domain local groups may indicate resource-specific access patterns.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Follow Microsoft’s AGDLP/AGUDLP best practices:
- Use domain local groups to assign permissions to resources in their domain
- Nest global or universal groups (containing users) into domain local groups
- Avoid adding individual users directly to domain local groups
- Name domain local groups according to their resource access purpose (e.g., “DL-FileServer01-Modify”)
- Document all resources each domain local group provides access to
How the Test Works
Section titled “How the Test Works”This test examines all group objects and identifies those where:
- The
GroupScopeproperty equals “DomainLocal” - These groups can only assign permissions to resources in their own domain
The test provides counts and percentages to understand the distribution of group scopes in your environment.
Related Tests
Section titled “Related Tests”Test-MtAdGroupDistributionCount- Counts distribution groups (email-only)Test-MtAdGroupSecurityCount- Counts security groups by categoryTest-MtAdGroupGlobalCount- Counts global scope groupsTest-MtAdGroupUniversalCount- Counts universal scope groups
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.