Skip to main content
Version: 2.2.1-preview

AD-USER-10 - Workstation-restricted user count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Restricting where a user can log on can reduce exposure for privileged, administrative, or sensitive accounts. Measuring how often workstation restrictions are used helps assess adoption of this hardening control.

Security Recommendation​

Consider applying workstation restrictions to privileged and high-value accounts where operationally feasible. Review configured restrictions periodically to ensure they remain accurate.

How the Test Works​

This test retrieves Active Directory user data from Get-MtADDomainState and counts accounts where LogonWorkstations is populated.

  • Test-MtAdUserDelegationAllowedCount
  • Test-MtAdUserDormantEnabledCount
  • Test-MtAdUserNeverLoggedInCount

Test Metadata​

FieldValue
Test IDAD-USER-10
SeverityInfo
SuiteActive Directory
CategoryAD.User
PowerShell testTest-MtAdUserWorkstationRestrictionCount
TagsAD, AD-USER-10, AD.User

Source​

  • Pester test: tests/ad/user/Test-MtAdUserWorkstationRestrictionCount.Tests.ps1
  • PowerShell source: powershell/public/ad/user/Test-MtAdUserWorkstationRestrictionCount.ps1