{"id":4784,"date":"2025-10-08T20:03:00","date_gmt":"2025-10-09T00:03:00","guid":{"rendered":"https:\/\/adsecurity.org\/?p=4784"},"modified":"2026-02-27T13:16:55","modified_gmt":"2026-02-27T18:16:55","slug":"active-directory-security-tip-13-kerberos-delegation","status":"publish","type":"post","link":"https:\/\/adsecurity.org\/?p=4784","title":{"rendered":"Active Directory Security Tip #13: Reviewing Foreign Security Principals (FSPs)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Review the membership of groups for accounts and groups from another Active Directory forest (technically another domain, but using forest here). These are called &#8220;<a href=\"https:\/\/learn.microsoft.com\/en-us\/openspecs\/windows_protocols\/ms-adts\/5aa09c90-c5db-4e97-98d0-b7cdd6bc1bfe\" data-type=\"link\" data-id=\"https:\/\/learn.microsoft.com\/en-us\/openspecs\/windows_protocols\/ms-adts\/5aa09c90-c5db-4e97-98d0-b7cdd6bc1bfe\">Foreign Security Principals<\/a>&#8221; (FSPs) like the ones highlighted in the image. These FSPs are accounts that exist in another forest but have rights in the AD forest. <br><br>Any FSPs should be scrutinized and removed if not required. It&#8217;s important to review and strictly control these since they may be highly privileged. In this example, compromise of another AD forest (TRDNET) would result in compromise of the current AD forest (Trd.com). <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"391\" height=\"470\" src=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2025\/10\/ADSecTip-FSPs-Administrators-GUI.jpg\" alt=\"\" class=\"wp-image-4785\" srcset=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2025\/10\/ADSecTip-FSPs-Administrators-GUI.jpg 391w, https:\/\/adsecurity.org\/wp-content\/uploads\/2025\/10\/ADSecTip-FSPs-Administrators-GUI-250x300.jpg 250w\" sizes=\"auto, (max-width: 391px) 100vw, 391px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"695\" height=\"406\" src=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2025\/10\/ADSecTip-FSPs-PowerShell.jpg\" alt=\"\" class=\"wp-image-4786\" srcset=\"https:\/\/adsecurity.org\/wp-content\/uploads\/2025\/10\/ADSecTip-FSPs-PowerShell.jpg 695w, https:\/\/adsecurity.org\/wp-content\/uploads\/2025\/10\/ADSecTip-FSPs-PowerShell-300x175.jpg 300w\" sizes=\"auto, (max-width: 695px) 100vw, 695px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><br><strong>PowerShell script to scan privileged groups for FSPs<\/strong>: <br><a href=\"https:\/\/github.com\/PyroTek3\/ActiveDirectory\/blob\/main\/Invoke-FindPrivilegedFSPs.ps1\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/github.com\/PyroTek3\/ActiveDirectory\/blob\/main\/Invoke-FindPrivilegedFSPs.ps1<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Review the membership of groups for accounts and groups from another Active Directory forest (technically another domain, but using forest here). These are called &#8220;Foreign Security Principals&#8221; (FSPs) like the ones highlighted in the image. These FSPs are accounts that exist in another forest but have rights in the AD forest. Any FSPs should be &hellip; <\/p>\n<p><a class=\"more-link btn\" href=\"https:\/\/adsecurity.org\/?p=4784\">Continue reading<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[565,7,2],"tags":[20,1469,1533,1535,1534],"class_list":["post-4784","post","type-post","status-publish","format-standard","hentry","category-activedirectorysecurity","category-powershell","category-technical-reference","tag-activedirectory","tag-activedirectorysecuritytip","tag-foreignsecurityprincipals","tag-fsp","tag-fsps","item-wrap"],"_links":{"self":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/4784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4784"}],"version-history":[{"count":4,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/4784\/revisions"}],"predecessor-version":[{"id":4964,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/4784\/revisions\/4964"}],"wp:attachment":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}