Skip to main content
Version: 2.2.1-preview

AD-USER-11 - User AdminCount count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

The AdminCount attribute is commonly set on protected and privileged accounts. These users often inherit AdminSDHolder protections and may retain elevated access or restricted ACL inheritance.

  • Privilege visibility: Highlights accounts that may be administrative or formerly administrative
  • Delegation impact: Protected accounts behave differently from standard users
  • Security review: Helps identify users that warrant stronger monitoring and change control

Security Recommendation​

  • Review each account with AdminCount = 1 to confirm it still requires elevated protections
  • Validate that privileged accounts are intentionally assigned and documented
  • Investigate stale or unexpected protected users and remove unnecessary privileged group membership

How the Test Works​

This test counts user objects where the AdminCount attribute equals 1.

  • Test-MtAdUserNonStandardPrimaryGroupCount - Finds users with unusual group membership baselines
  • Test-MtAdUserSpnSetCount - Identifies potentially high-value service accounts

Test Metadata​

FieldValue
Test IDAD-USER-11
SeverityInfo
SuiteActive Directory
CategoryAD.User
PowerShell testTest-MtAdUserAdminCountCount
TagsAD, AD-USER-11, AD.User

Source​

  • Pester test: tests/ad/user/Test-MtAdUserAdminCountCount.Tests.ps1
  • PowerShell source: powershell/public/ad/user/Test-MtAdUserAdminCountCount.ps1