Skip to content
MitoMito Docs

AD-GRP-10: Universal group count should be retrievable
ID AD-GRP-10
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Groups
Security area Infrastructure hardening
Resource type Group
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Universal groups play a specific role in multi-domain Active Directory environments:

  • Cross-domain flexibility: Can contain users and groups from any domain in the forest
  • Forest-wide access: Can be used for access control across the entire forest
  • Global Catalog storage: Group membership is stored in the Global Catalog
  • Replication impact: Membership changes trigger forest-wide replication
  • Multi-domain consolidation: Useful for nesting global groups from multiple domains

High numbers of universal groups may indicate a complex multi-domain environment or potential replication optimization opportunities.

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”

Use universal groups strategically:

  1. Minimize membership changes to universal groups to reduce replication traffic
  2. Use universal groups primarily in multi-domain environments where cross-domain access is needed
  3. Nest global groups (containing users) into universal groups rather than adding users directly
  4. Consider the replication impact when designing universal group structure
  5. Document the forest-wide access each universal group provides
  6. In single-domain environments, prefer global and domain local groups

How the Test Works

Section titled “How the Test Works”

This test examines all group objects and identifies those where:

  • The GroupScope property equals “Universal”
  • These groups can contain members from any domain in the forest
  • Membership is stored in the Global Catalog

The test provides counts and percentages to understand the distribution of group scopes in your environment.

Section titled “Related Tests”
  • Test-MtAdGroupDistributionCount - Counts distribution groups (email-only)
  • Test-MtAdGroupSecurityCount - Counts security groups by category
  • Test-MtAdGroupDomainLocalCount - Counts domain local scope groups
  • Test-MtAdGroupGlobalCount - Counts global scope groups

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.