Optional feature enabled details should be investigated
AD-FEAT-02InfoActive DirectoryDirectory configuration
Part of Active Directory · Active Directory · Directory configuration · All checks
Invoke-Maester -TestId AD-FEAT-02Overview
Section titled “Overview”Understanding which Active Directory optional features are enabled and their scope is crucial for security management:
- Recycle Bin: Should be enabled at the forest level for object recovery capabilities
- Privileged Access Management: May be enabled for specific domains or the entire forest
- Feature Scope: Knowing where features are enabled helps ensure consistent security policies
Enabled optional features represent additional capabilities that can enhance security but also increase the attack surface if not properly managed.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Enable Recycle Bin at the forest level if not already enabled
- Document all enabled optional features and their scope
- Regularly review enabled features to ensure they align with security requirements
- Understand the implications of each enabled feature
- Monitor for unauthorized enabling of optional features
How the Test Works
Section titled “How the Test Works”This test retrieves detailed information about enabled optional features:
- Total optional features available
- Number of features with enabled scopes
- Feature names and their enabled scope counts
- Detailed breakdown of each enabled feature
Related Tests
Section titled “Related Tests”Test-MtAdOptionalFeatureCount- Counts total available optional featuresTest-MtAdRecycleBinStatus- Specifically checks Recycle Bin status
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-FEAT-02 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Directory configuration |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdOptionalFeatureEnabledDetails |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:msDS-OptionalFeature:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/replication/Test.AD-FEAT-02.ps1 - Documentation:
tests/ad/replication/Test.AD-FEAT-02.md