AD activation objects count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Directory configuration · All checks

Run this check

Invoke-Maester -TestId AD-CFG-09

Overview

AD-based activation objects are used by Windows for volume activation and related discovery workflows. If these objects are created, deleted, or altered without authorization, it can indicate licensing/tampering activity and may also reflect broader Active Directory compromise or unauthorized configuration changes.

Control Type

Operational

Security Recommendation

• Treat activation-object changes as security-relevant change-management events.
• Restrict who can create/modify activation objects (least privilege) and remove unnecessary write permissions.
• Establish a known-good baseline for the number of activation objects per environment/forest and alert on deviations.
• Review recent directory change/audit events to identify the initiating account and purpose.

How the Test Works

• Enumerates activation-related objects stored in Active Directory.
• Counts the objects discovered in the activation container(s).
• Compares the count to an environment baseline and flags unexpected increases/decreases.

Related Tests

• Test-MtAdWellKnownSecurityPrincipalsCount: Detects unexpected identity/config changes that may accompany tampering.
• Test-MtAdRegisteredDhcpServersCount: Detects unauthorized network services registered in AD.

Details

Every attribute of this check

Field	Value
Test ID	AD-CFG-09
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Directory configuration
Area	Infrastructure hardening
Resource type	Tenant
MITRE ATT&CK	None
PowerShell test	Test-MtAdAdActivationObjectsCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:Configuration/*:ReadProperty

Source

• Test: tests/ad/config/Test.AD-CFG-09.ps1
• Documentation: tests/ad/config/Test.AD-CFG-09.md