Reversible encryption user count should be retrievable
AD-USER-04InfoActive DirectoryUsers
Part of Active Directory · Active Directory · Users · All checks
Invoke-Maester -TestId AD-USER-04Overview
Section titled “Overview”Reversible password encryption is effectively equivalent to storing passwords in a decryptable form. Accounts configured this way create serious exposure if the directory or credential material is compromised.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”Disable reversible password encryption unless it is required for a documented legacy dependency that cannot be modernized immediately. Remediate those dependencies as a priority.
How the Test Works
Section titled “How the Test Works”This test retrieves Active Directory user data from Get-MtADDomainState and counts accounts with reversible-encryption-style indicators. It checks explicit reversible encryption properties when available and falls back to the relevant userAccountControl flag.
Related Tests
Section titled “Related Tests”Test-MtAdUserKerberosDesOnlyCountTest-MtAdUserPasswordNotRequiredCountTest-MtAdUserNoPreAuthCount
Related links
Section titled “Related links”- Microsoft Defender for Identity: Unsecure account attributes
- ANSSI Active Directory checkpoints: Privileged accounts with passwords stored using reversible encryption
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-USER-04 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Users |
| Area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1556.005 Reversible Encryption |
| PowerShell test | Test-MtAdUserReversibleEncryptionCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/user/Test.AD-USER-04.ps1 - Documentation:
tests/ad/user/Test.AD-USER-04.md