Workstation-restricted user count should be retrievable
AD-USER-10InfoActive DirectoryUsers
Part of Active Directory · Active Directory · Users · All checks
Invoke-Maester -TestId AD-USER-10Overview
Section titled “Overview”Restricting where a user can log on can reduce exposure for privileged, administrative, or sensitive accounts. Measuring how often workstation restrictions are used helps assess adoption of this hardening control.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”Consider applying workstation restrictions to privileged and high-value accounts where operationally feasible. Review configured restrictions periodically to ensure they remain accurate.
How the Test Works
Section titled “How the Test Works”This test retrieves Active Directory user data from Get-MtADDomainState and counts accounts where LogonWorkstations is populated.
Related Tests
Section titled “Related Tests”Test-MtAdUserDelegationAllowedCountTest-MtAdUserDormantEnabledCountTest-MtAdUserNeverLoggedInCount
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-USER-10 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Users |
| Area | Access control |
| Resource type | User |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdUserWorkstationRestrictionCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/user/Test.AD-USER-10.ps1 - Documentation:
tests/ad/user/Test.AD-USER-10.md