Skip to main content
Version: 2.1.1-preview

Test-MtAdKrbtgtNonStandardUacCount

SYNOPSIS​

Checks if the KRBTGT account has non-standard User Account Control (UAC) settings.

SYNTAX​

Test-MtAdKrbtgtNonStandardUacCount [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

The KRBTGT account should have a standard UAC value of 514 (disabled, normal account). This test checks if the KRBTGT account has any non-standard UAC settings that could indicate misconfiguration or potential security issues.

Standard KRBTGT UAC:

  • ACCOUNTDISABLE (0x0002) - Account should be disabled
  • NORMAL_ACCOUNT (0x0200) - Normal user account
  • Expected combined value: 514 (0x0202)

Security Concern:

  • KRBTGT should NEVER be enabled
  • Non-standard UAC may indicate tampering or misconfiguration
  • Additional flags like DONT_EXPIRE_PASSWORD are sometimes set but should be reviewed

EXAMPLES​

EXAMPLE 1​

Test-MtAdKrbtgtNonStandardUacCount

Returns $true if KRBTGT has standard UAC settings.

PARAMETERS​

-ProgressAction​

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

System.Boolean​

NOTES​

https://maester.dev/docs/commands/Test-MtAdKrbtgtNonStandardUacCount