Optional feature count should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Directory configuration · All checks

Run this check

Invoke-Maester -TestId AD-FEAT-01

Overview

Active Directory optional features extend the base functionality of AD and can significantly impact security capabilities:

• Recycle Bin: Critical for recovering accidentally or maliciously deleted objects
• Privileged Access Management (PAM): Enables time-based group membership for just-in-time access
• Feature Awareness: Understanding available features helps assess security posture

Knowing which optional features are available helps administrators understand the full capabilities of their Active Directory environment and identify opportunities to enhance security.

Control Type

Operational

Security Recommendation

• Enable the Active Directory Recycle Bin if not already enabled
• Consider PAM for privileged access scenarios
• Regularly review available optional features
• Keep domain and forest functional levels current to access newer features
• Document enabled optional features and their configuration

How the Test Works

This test retrieves all Active Directory optional features and counts:

• Total number of optional features available
• List of feature names

Related Tests

• Test-MtAdOptionalFeatureEnabledDetails - Provides detailed information about enabled features
• Test-MtAdRecycleBinStatus - Checks if the Recycle Bin is enabled

Details

Every attribute of this check

Field	Value
Test ID	AD-FEAT-01
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Directory configuration
Area	Infrastructure hardening
Resource type	Tenant
MITRE ATT&CK	None
PowerShell test	Test-MtAdOptionalFeatureCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:msDS-OptionalFeature:ReadProperty

Source

• Test: tests/ad/replication/Test.AD-FEAT-01.ps1
• Documentation: tests/ad/replication/Test.AD-FEAT-01.md