AD-USER-04 - Reversible encryption user count should be retrievable

Contributed by Michael Soule with 2 co-contributorsAll contributors →

Overview

Reversible password encryption is effectively equivalent to storing passwords in a decryptable form. Accounts configured this way create serious exposure if the directory or credential material is compromised.

Security Recommendation

Disable reversible password encryption unless it is required for a documented legacy dependency that cannot be modernized immediately. Remediate those dependencies as a priority.

How the Test Works

This test retrieves Active Directory user data from Get-MtADDomainState and counts accounts with reversible-encryption-style indicators. It checks explicit reversible encryption properties when available and falls back to the relevant userAccountControl flag.

Related Tests

• Test-MtAdUserKerberosDesOnlyCount
• Test-MtAdUserPasswordNotRequiredCount
• Test-MtAdUserNoPreAuthCount

Related links

• Microsoft Defender for Identity: Unsecure account attributes
• ANSSI Active Directory checkpoints: Privileged accounts with passwords stored using reversible encryption

Test Metadata

Field	Value
Test ID	AD-USER-04
Severity	Medium
Suite	Active Directory
Category	AD.User
PowerShell test	Test-MtAdUserReversibleEncryptionCount
Tags	AD, AD-USER-04, AD.User

Source

• Pester test: tests/ad/user/Test-MtAdUserReversibleEncryptionCount.Tests.ps1
• PowerShell source: powershell/public/ad/user/Test-MtAdUserReversibleEncryptionCount.ps1