Skip to main content
Version: 2.2.1-preview

AD-USER-01 - Disabled user count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Disabled user accounts are expected during offboarding, investigations, and staged deprovisioning. Tracking their volume helps identify stale objects that should be deleted, reduces directory clutter, and supports lifecycle governance.

Security Recommendation​

Review disabled user accounts regularly and remove accounts that no longer need to exist. For retained accounts, document the business reason and expected retention period.

How the Test Works​

This test retrieves cached Active Directory user data from Get-MtADDomainState and counts user objects where Enabled = $false. The result includes total, enabled, and disabled user counts plus the disabled percentage.

  • Test-MtAdUserDormantEnabledCount
  • Test-MtAdUserNeverLoggedInCount
  • Test-MtAdUserPasswordNotRequiredCount

Test Metadata​

FieldValue
Test IDAD-USER-01
SeverityInfo
SuiteActive Directory
CategoryAD.User
PowerShell testTest-MtAdUserDisabledCount
TagsAD, AD-USER-01, AD.User

Source​

  • Pester test: tests/ad/user/Test-MtAdUserDisabledCount.Tests.ps1
  • PowerShell source: powershell/public/ad/user/Test-MtAdUserDisabledCount.ps1