Skip to main content
Version: 2.2.1-preview

AD-USER-08 - Never-logged-in enabled user count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Enabled accounts that have never logged on may indicate incomplete provisioning, abandoned onboarding, or unnecessary standing access. These objects should be reviewed to ensure they still have a valid business purpose.

Security Recommendation​

Investigate enabled accounts with no recorded logon activity. Disable or remove unused accounts and make sure future provisioning workflows include validation and cleanup steps.

How the Test Works​

This test retrieves Active Directory user data from Get-MtADDomainState, filters to enabled users, and counts accounts where LastLogonDate is null.

  • Test-MtAdUserDormantEnabledCount
  • Test-MtAdUserDisabledCount
  • Test-MtAdUserPasswordNeverExpiresCount

Test Metadata​

FieldValue
Test IDAD-USER-08
SeverityInfo
SuiteActive Directory
CategoryAD.User
PowerShell testTest-MtAdUserNeverLoggedInCount
TagsAD, AD-USER-08, AD.User

Source​

  • Pester test: tests/ad/user/Test-MtAdUserNeverLoggedInCount.Tests.ps1
  • PowerShell source: powershell/public/ad/user/Test-MtAdUserNeverLoggedInCount.ps1