AD-USER-03 - Non-expiring password user count should be retrievable

Contributed by Michael SouleAll contributors →

Overview

Passwords that never expire reduce credential hygiene and increase the blast radius of password theft. While some service accounts may require non-expiring credentials, they should be rare, controlled, and closely monitored.

Control Type

Detective

Security Recommendation

Minimize the use of non-expiring passwords. Where legacy constraints require them, migrate to managed service accounts, vaulting, or other compensating controls.

How the Test Works

This test retrieves Active Directory user data from Get-MtADDomainState, filters to enabled users, and counts accounts where PasswordNeverExpires = $true. The output includes the count and percentage relative to enabled users.

Related Tests

• Test-MtAdUserDormantEnabledCount
• Test-MtAdUserPasswordNotRequiredCount
• Test-MtAdUserNeverLoggedInCount

Related links

• ANSSI Active Directory checkpoints: Accounts with never-expiring passwords

Test Metadata

Field	Value
Test ID	AD-USER-03
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Users
Area	Authentication
Resource type	User
MITRE ATT&CK	T1078.002 Domain Accounts
PowerShell test	Test-MtAdUserPasswordNeverExpiresCount
Services	ActiveDirectory

Source

• Test: tests/ad/user/Test.AD-USER-03.ps1
• Documentation: tests/ad/user/Test.AD-USER-03.md