Never-logged-in enabled user count should be retrievable
AD-USER-08InfoActive DirectoryUsers
Part of Active Directory · Active Directory · Users · All checks
Invoke-Maester -TestId AD-USER-08Overview
Section titled “Overview”Enabled accounts that have never logged on may indicate incomplete provisioning, abandoned onboarding, or unnecessary standing access. These objects should be reviewed to ensure they still have a valid business purpose.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”Investigate enabled accounts with no recorded logon activity. Disable or remove unused accounts and make sure future provisioning workflows include validation and cleanup steps.
How the Test Works
Section titled “How the Test Works”This test retrieves Active Directory user data from Get-MtADDomainState, filters to enabled users, and counts accounts where LastLogonDate is null.
Related Tests
Section titled “Related Tests”Test-MtAdUserDormantEnabledCountTest-MtAdUserDisabledCountTest-MtAdUserPasswordNeverExpiresCount
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-USER-08 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Users |
| Area | Identity lifecycle and hygiene |
| Resource type | User |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdUserNeverLoggedInCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/user/Test.AD-USER-08.ps1 - Documentation:
tests/ad/user/Test.AD-USER-08.md