Computer disabled count should be retrievable
AD-COMP-01InfoActive DirectoryComputers
Part of Active Directory · Active Directory · Computers · All checks
Invoke-Maester -TestId AD-COMP-01Overview
Section titled “Overview”Disabled computer accounts that remain in Active Directory represent a security hygiene issue. While disabling a computer account is a valid administrative action (typically when decommissioning systems), these accounts should eventually be removed to:
- Reduce attack surface: Disabled accounts can be re-enabled by attackers who gain privileged access
- Prevent confusion: Distinguish between active and truly decommissioned systems
- Maintain directory cleanliness: Simplify auditing and compliance reporting
- Avoid stale data: Ensure Group Policy and software deployment targets are accurate
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”Regularly review disabled computer accounts and delete those that are permanently decommissioned. Consider establishing a process where disabled computers are automatically deleted after a defined retention period (e.g., 30-90 days).
How the Test Works
Section titled “How the Test Works”This test retrieves all computer objects from Active Directory and counts:
- Total number of computer accounts
- Number of disabled computer accounts
- Percentage of computers that are disabled
The test returns informational results to help you assess the scope of disabled accounts in your environment.
Related Tests
Section titled “Related Tests”Test-MtAdComputerDormantCount- Identifies enabled computers that haven’t logged on recentlyTest-MtAdComputerInDefaultContainer- Finds computers in the default container (another hygiene indicator)
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-COMP-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Computers |
| Area | Identity lifecycle and hygiene |
| Resource type | Computer |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdComputerDisabledCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/computer/Test.AD-COMP-01.ps1 - Documentation:
tests/ad/computer/Test.AD-COMP-01.md