AD-TRUST-07: Trust stale details should be investigated


ID	`AD-TRUST-07`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Trusts
Security area	External access and sharing
Resource type	Trust
Reads from	On-premises Active Directory

What this checks and how to fix it

Identifying specific stale trusts enables targeted remediation:

Prioritization: Focus cleanup efforts on the oldest, most likely unused trusts
Investigation: Specific target domains can be investigated for existence and need
Risk Assessment: Older trusts may represent higher security risks
Documentation: Detailed stale trust information supports decision-making
Compliance: Demonstrates active trust management for audits

Stale trusts often accumulate over time as:

Temporary project trusts are forgotten
Acquired company domains are decommissioned
Network restructuring leaves orphaned connections
Test environments are removed without cleanup

Control Type

Operational

Security Recommendation

Investigation Process:

Identify Target Domain: Determine if the target domain still exists
Check Business Need: Verify if any systems still require the trust
Test Validation: Attempt manual trust validation
Plan Removal: Schedule removal if trust is confirmed unused
Document: Record removal rationale for audit purposes

Sample Investigation Commands:

#### Test if the trust can be validated
Test-ADTrust -Target <TrustName>

#### Check when the trust was created
Get-ADTrust -Filter {Target -eq "<TrustName>"} -Properties Created

#### View detailed trust information
Get-ADTrust -Filter {Target -eq "<TrustName>"} -Properties *

Removal Process:

Notify stakeholders before removing production trusts
Remove during maintenance windows
Document removal in change management system
Monitor for any authentication failures after removal

How the Test Works

This test identifies trusts where LastValidated is more than 60 days old and displays:

Target domain name
Trust direction
Last validation date
Days since last validation
Trust type

Results are sorted by last validation date (oldest first).

Test-MtAdTrustStaleCount - Count of stale trusts
Test-MtAdTrustTotalCount - Overall trust count
Test-MtAdTrustDetails - Complete trust configuration information

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).