member count

< positive integer
= | != | > non-negative integer

Purpose

AD group member count is less than, equal to, not equal to, or greater than the specified requirement.

Notes

This requirement may be repeated in the same section.

Where this requirement might be used

AD groups where the membership count only changes at infrequent and important events — the unit gains/loses a department, the unit alters its licensing purchase for a program or service and the group contains those users who are allowed to login to the program/service, the number of security groups is known and any change is likely to indicate a permissions mistake was made, etc.
AD groups that should never become empty (member count != 0) — if this group has no members, that's a sign that a role is going unfilled, a license is not being used, and so on.
AD groups where the member count is not precisely known but there are reasonable boundaries (member count < 3 and/or member count > 12 meaning the count never goes below 3 or above 12).

Example configuration

# Warn on groups with members (non-empty groups).
[group:"Field Consultants" "CN=Field Services OU Admins,OU=FC Groups,OU=Field Consulting,OU=Delegated,OU=TechServices,OU=Urbana,DC=ad,DC=uillinois,DC=edu" "CN=Tech Services FC Tech\*,OU=FC Groups,OU=Field Consulting,OU=Delegated,OU=TechServices,OU=Urbana,DC=ad,DC=uillinois,DC=edu" "03efc439-b0dc-4615-afed-646fd22dfe34"]
member count = 0

Example output

Line 5: The following 4 AD groups have member counts other than 0 members—expected exactly 0 members in each group:

Group sAMAccountName	Group member count
FCTechOps	5
Field Consultants	15
FC-Unix	2
Field Services OU Admins	2

Example configuration

[group:"Field Consultants" "CN=Field Services OU Admins,OU=FC Groups,OU=Field Consulting,OU=Delegated,OU=TechServices,OU=Urbana,DC=ad,DC=uillinois,DC=edu" "CN=Tech Services FC Tech\*,OU=FC Groups,OU=Field Consulting,OU=Delegated,OU=TechServices,OU=Urbana,DC=ad,DC=uillinois,DC=edu" "03efc439-b0dc-4615-afed-646fd22dfe34"]
# member count between 9-19 inclusive.
member count > 10
member count < 20

Example output

Line 10: The following 3 AD groups have fewer than expected numbers of members—expected more than 10 members in each group:

Group sAMAccountName	Group member count
FCTechOps	5
FC-Unix	2
Field Services OU Admins	2

Note that the member count < 20 requirement generated no warnings.