Optional features count should be retrievable
AD-CFG-04InfoActive DirectoryDirectory configuration
Part of Active Directory · Active Directory · Directory configuration · All checks
Invoke-Maester -TestId AD-CFG-04Overview
Section titled “Overview”Active Directory optional features (and related feature flags) enable or enhance behaviors such as recoverability and directory management capabilities. Incorrectly enabled/disabled features can materially affect your security posture by:
- Reducing your ability to recover from accidental or malicious deletion
- Leaving legacy behaviors in place longer than necessary
- Causing operational drift that attackers can exploit via misconfiguration
In particular, features that improve recovery (such as those related to the Recycle Bin) directly impact resilience during incidents.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Ensure critical recoverability features (notably Recycle Bin) are enabled for the partitions that contain important identity data.
- Treat optional feature changes as security configuration changes: use a change control process, test first, and validate after enabling/disabling.
- Keep optional feature configuration consistent across domains/partitions where required.
How the Test Works
Section titled “How the Test Works”This test retrieves the set of enabled AD optional feature flags and reports them as a count/visibility metric so administrators can confirm whether the expected security-enhancing features are active.
Related Tests
Section titled “Related Tests”Test-MtAdRecycleBinEnabledPaths- Shows where Recycle Bin is enabled.Test-MtAdRecycleBinStatus- Validates the Recycle Bin state.
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-CFG-04 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Directory configuration |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdOptionalFeaturesCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:msDS-OptionalFeature:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/config/Test.AD-CFG-04.ps1 - Documentation:
tests/ad/config/Test.AD-CFG-04.md