Look for shrinking trust complexity, fewer orphaned accounts, clearer ownership, and a documented retirement path for every legacy forest or domain. If those signals are missing, the programme is probably reducing clutter without reducing governance risk.
What “working” means for AD cleanup
AD cleanup is not successful just because you deleted a batch of stale objects. It is working only when the directory becomes simpler to reason about and safer to operate: trust paths shrink, ownership becomes visible, and retirement work is tied to a real end state. That is the difference between cosmetic pruning and actual governance improvement.
A useful test is whether the cleanup produces decisions that operators can defend later. If a domain, trust, or forest remains in place without a documented owner, business justification, or expiry path, the directory may look tidier while the underlying governance model stays brittle.
Teams should also expect the cleanup to change how future changes are handled. When cleanup is effective, new exceptions become rarer, the remaining structure is easier to inventory, and the organisation can explain why each surviving domain or trust still exists instead of inheriting it by accident.
What signals show the directory is actually becoming healthier?
The most reliable signals are operational, not cosmetic. Fewer orphaned accounts matter because they indicate that ownership, lifecycle, and decommissioning are being managed. Clearer ownership matters because every surviving admin group, service account, trust, and legacy dependency should map to a named decision-maker.
Another strong signal is reduced trust complexity. That means fewer unnecessary cross-domain dependencies, fewer legacy exceptions, and fewer places where old assumptions survive inside authentication and authorization paths. A cleaner diagram is not enough unless the number of implicit trust relationships also falls.
Look for evidence that retirement is being completed, not postponed. A documented retirement path for each legacy forest or domain is a practical control signal because it shows the team can move from discovery to closure, rather than repeatedly rediscovering the same obsolete structure during every audit or incident review.
How to judge whether cleanup is reducing risk rather than just moving it around
Cleanup that only shifts objects, trusts, or admin rights can leave the attack surface unchanged. The question is whether the work reduces the number of places where a compromised account, forgotten trust, or inherited privilege can create reach beyond its intended scope.
Healthy cleanup also improves observability. If operators can no longer tell which forest or domain owns a system, who maintains a trust, or how a legacy path is retired, then the directory remains exposed to silent drift. That is a governance problem even when day-to-day logins still work.
For teams that need a control baseline, the relevant principle is to map cleanup to the directory lifecycle, access boundaries, and retirement evidence that prove the change is durable. NIST SP 800-53 Rev 5 Security and Privacy Controls supports that style of verification through its access, audit, and configuration control families, while NIST Cybersecurity Framework 2.0 reinforces the need to govern and recover directory changes in a measurable way. For teams cleaning up legacy trust paths and privilege sprawl, NIST Cybersecurity Framework 2.0 is most useful when you treat cleanup as a governance and recovery exercise, not a one-time maintenance task.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | AD cleanup depends on finding and retiring stale accounts and ownership gaps. |
| AC-6 — Least Privilege | Cleanup should reduce unnecessary trust and privilege inherited across domains. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Teams need evidence that cleanup changed the environment in durable, observable ways. | |
| Recommendation — Review and remove dormant accounts, then verify each remaining account has a current owner and purpose. Reduce inherited permissions and trust paths to the minimum required for each surviving directory relationship. Use audit evidence to confirm deletions, trust changes, and retirements actually occurred and remain in effect. | ||
| ISO/IEC 27001:2022 | A.5.9 — Inventory of information and other associated assets | AD cleanup requires an accurate inventory of domains, trusts, and directory assets. |
| A.5.15 — Access control | Cleanup should reduce unnecessary access paths and clarify remaining access boundaries. | |
| Recommendation — Maintain an up-to-date inventory of directory assets and retire entries only when ownership and status are clear. Tighten directory access boundaries so only necessary trusts and administrative paths remain. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems within the organization are inventoried | Directory cleanup should be measured against a reliable inventory of what still exists. |
| PR.AA-05 — Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties | Legacy directory cleanup should remove excess authorization paths and inherited privilege. | |
| GV.RM-03 — Risk identification, estimation, and prioritization are used to inform decision making | Success depends on proving cleanup lowers governance risk, not just clutter. | |
| Recommendation — Keep a current inventory of forests, domains, trusts, and dependent systems before and after cleanup. Revoke unnecessary trust-based and administrative access paths as part of the cleanup program. Prioritize cleanup items that most reduce trust complexity, orphaned access, and unrecovered legacy dependency risk. | ||
Practitioner Guidance
What to verify: Require evidence that each removed object, trust, or domain had an owner, a reason to exist, and a retirement record. If the team cannot produce that trail, the cleanup is probably deleting symptoms rather than closing the control gap.
What good looks like: The remaining environment should be smaller, easier to map, and easier to explain under pressure. If a responder can quickly answer who owns a trust, why a legacy forest still exists, and when it will be retired, the cleanup is doing real work.
Common mistake: Treating fewer objects as success. A directory can have less clutter and the same governance risk if orphaned dependencies, undocumented trusts, and unclear ownership still remain.
Practitioner takeaway: Measure cleanup by whether it improves accountability and removes structural ambiguity, not by how much inventory disappeared.
Related resources from NHI Mgmt Group
- How can security teams tell whether certificate trust cleanup is actually working?
- How can teams tell whether front-channel logout is actually working across applications?
- How can teams tell whether data classification is actually working?
- How can teams tell whether access governance is actually working?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 10, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org