DES-only Kerberos user count should be retrievable
AD-USER-06InfoActive DirectoryUsers
Part of Active Directory · Active Directory · Users · All checks
Invoke-Maester -TestId AD-USER-06Overview
Section titled “Overview”DES is an obsolete Kerberos encryption type with known cryptographic weakness. Accounts limited to DES-only support should be considered legacy debt and prioritized for cleanup.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”Move DES-only accounts to stronger Kerberos encryption types such as AES and eliminate dependencies on deprecated protocols. Validate application compatibility before enforcement.
How the Test Works
Section titled “How the Test Works”This test retrieves Active Directory user data from Get-MtADDomainState and counts accounts whose Kerberos settings indicate DES usage. It checks KerberosEncryptionType when available and falls back to UseDESKeyOnly.
Related Tests
Section titled “Related Tests”Test-MtAdUserDelegationAllowedCountTest-MtAdUserReversibleEncryptionCountTest-MtAdUserNoPreAuthCount
Related links
Section titled “Related links”- Microsoft Defender for Identity: Unsecure account attributes
- ANSSI Active Directory checkpoints: Use of Kerberos with weak encryption
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-USER-06 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Users |
| Area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets |
| PowerShell test | Test-MtAdUserKerberosDesOnlyCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/user/Test.AD-USER-06.ps1 - Documentation:
tests/ad/user/Test.AD-USER-06.md