AD-TRUST-06 - Trust stale count should be investigated

Contributed by Michael SouleAll contributors →

Overview

Stale trusts (those not validated for extended periods) indicate potential issues:

• Decommissioned Domains: The target domain may no longer exist
• Connectivity Issues: Network problems preventing trust validation
• Orphaned Trusts: Trusts created for temporary purposes that were never removed
• Security Hygiene: Unused trusts increase attack surface unnecessarily
• Operational Risk: Stale trusts may fail unexpectedly when needed

Trust validation occurs when the trusting domain attempts to verify the trust relationship with the trusted domain. If this hasn't happened within StaleThresholdDays (default 60), it suggests the trust is not actively used.

Control Type

Operational

Security Recommendation

Immediate Actions:

• Review all stale trusts to determine if they are still needed
• Test connectivity to the target domain
• Verify the target domain still exists

Remediation Steps:

1. Verify Need: Confirm if the trust serves a business purpose
2. Test Connectivity: Attempt to validate the trust manually
3. Remove if Unused: Delete trusts that are no longer needed
4. Document Exceptions: For trusts that must remain, document why

Command to Validate a Trust:

Test-ADTrust -Target <TrustName>

Command to Remove a Trust:

Remove-ADTrust -Target <TrustName>

How the Test Works

This test checks the LastValidated property of each trust. Trusts are considered stale if:

• LastValidated is not null
• LastValidated is older than StaleThresholdDays (default 60)

The test returns:

• Total trust count
• Count of stale trusts
• Count of trusts with unknown validation status
• Count of valid trusts

Related Tests

• Test-MtAdTrustStaleDetails - Lists specific stale trusts with details
• Test-MtAdTrustTotalCount - Overall trust count
• Test-MtAdTrustDetails - Complete trust configuration including last validated date

Test Metadata

Field	Value
Test ID	AD-TRUST-06
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Trusts
Area	External access and sharing
Resource type	Trust
MITRE ATT&CK	None
PowerShell test	Test-MtAdTrustStaleCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:trustedDomain:ReadProperty

Source

• Test: tests/ad/trust/Test.AD-TRUST-06.ps1
• Documentation: tests/ad/trust/Test.AD-TRUST-06.md