Disabled user count should be retrievable
AD-USER-01InfoActive DirectoryUsers
Part of Active Directory · Active Directory · Users · All checks
Invoke-Maester -TestId AD-USER-01Overview
Section titled “Overview”Disabled user accounts are expected during offboarding, investigations, and staged deprovisioning. Tracking their volume helps identify stale objects that should be deleted, reduces directory clutter, and supports lifecycle governance.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”Review disabled user accounts regularly and remove accounts that no longer need to exist. For retained accounts, document the business reason and expected retention period.
How the Test Works
Section titled “How the Test Works”This test retrieves cached Active Directory user data from Get-MtADDomainState and counts user objects where Enabled = $false. The result includes total, enabled, and disabled user counts plus the disabled percentage.
Related Tests
Section titled “Related Tests”Test-MtAdUserDormantEnabledCountTest-MtAdUserNeverLoggedInCountTest-MtAdUserPasswordNotRequiredCount
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-USER-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Users |
| Area | Identity lifecycle and hygiene |
| Resource type | User |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdUserDisabledCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/user/Test.AD-USER-01.ps1 - Documentation:
tests/ad/user/Test.AD-USER-01.md