Password-not-required user count should be retrievable
AD-USER-09InfoActive DirectoryUsers
Part of Active Directory · Active Directory · Users · All checks
Invoke-Maester -TestId AD-USER-09Overview
Section titled “Overview”Accounts that do not require passwords are a severe security weakness. Even if rarely used, they represent a misconfiguration that can undermine core authentication protections.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”Investigate every account with PasswordNotRequired set. Require passwords, rotate credentials, and validate that no workflow depends on this unsafe configuration.
How the Test Works
Section titled “How the Test Works”This test retrieves Active Directory user data from Get-MtADDomainState and counts accounts where PasswordNotRequired = $true. The output shows the total count and percentage of affected users.
Related Tests
Section titled “Related Tests”Test-MtAdUserPasswordNeverExpiresCountTest-MtAdUserNoPreAuthCountTest-MtAdUserReversibleEncryptionCount
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-USER-09 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Users |
| Area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1078.002 Domain Accounts |
| PowerShell test | Test-MtAdUserPasswordNotRequiredCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/user/Test.AD-USER-09.ps1 - Documentation:
tests/ad/user/Test.AD-USER-09.md