AD-USER-02 - Dormant enabled user count should be retrievable
Overview
Enabled user accounts that have not logged on for more than the configured threshold (default 90 days) are a common sign of weak identity hygiene. Forgotten but still-enabled accounts can retain access, group memberships, and password material that attackers may target.
Control Type
Detective
Security Recommendation
Investigate dormant enabled accounts and disable or remove those that are no longer needed. For exceptions such as break-glass or low-use service accounts, apply stronger controls and document ownership.
How the Test Works
This test retrieves Active Directory user data from Get-MtADDomainState, filters to enabled users, and counts accounts where LastLogonDate is older than DormantThresholdDays (default 90 days). The output shows the number and percentage of dormant enabled users.
Related Tests
Test-MtAdUserDisabledCountTest-MtAdUserNeverLoggedInCountTest-MtAdUserPasswordNeverExpiresCount
Related links
- Microsoft Defender for Identity: Remove stale Active Directory accounts
- ANSSI Active Directory checkpoints: Dormant accounts
Test Metadata
| Field | Value |
|---|---|
| Test ID | AD-USER-02 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Users |
| Area | Identity lifecycle and hygiene |
| Resource type | User |
| MITRE ATT&CK | T1078.002 Domain Accounts |
| Supports controls | nist-800-53-r5:AC-2(3) |
| PowerShell test | Test-MtAdUserDormantEnabledCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |
Source
- Test:
tests/ad/user/Test.AD-USER-02.ps1 - Documentation:
tests/ad/user/Test.AD-USER-02.md