Non-expiring password user count should be retrievable
AD-USER-03InfoActive DirectoryUsers
Part of Active Directory · Active Directory · Users · All checks
Invoke-Maester -TestId AD-USER-03Overview
Section titled “Overview”Passwords that never expire reduce credential hygiene and increase the blast radius of password theft. While some service accounts may require non-expiring credentials, they should be rare, controlled, and closely monitored.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”Minimize the use of non-expiring passwords. Where legacy constraints require them, migrate to managed service accounts, vaulting, or other compensating controls.
How the Test Works
Section titled “How the Test Works”This test retrieves Active Directory user data from Get-MtADDomainState, filters to enabled users, and counts accounts where PasswordNeverExpires = $true. The output includes the count and percentage relative to enabled users.
Related Tests
Section titled “Related Tests”Test-MtAdUserDormantEnabledCountTest-MtAdUserPasswordNotRequiredCountTest-MtAdUserNeverLoggedInCount
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-USER-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Users |
| Area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1078.002 Domain Accounts |
| PowerShell test | Test-MtAdUserPasswordNeverExpiresCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/user/Test.AD-USER-03.ps1 - Documentation:
tests/ad/user/Test.AD-USER-03.md