User AdminCount count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Users · All checks

Run this check

Invoke-Maester -TestId AD-USER-11

Overview

The AdminCount attribute is commonly set on protected and privileged accounts. These users often inherit AdminSDHolder protections and may retain elevated access or restricted ACL inheritance.

• Privilege visibility: Highlights accounts that may be administrative or formerly administrative
• Delegation impact: Protected accounts behave differently from standard users
• Security review: Helps identify users that warrant stronger monitoring and change control

Control Type

Detective

Security Recommendation

• Review each account with AdminCount = 1 to confirm it still requires elevated protections
• Validate that privileged accounts are intentionally assigned and documented
• Investigate stale or unexpected protected users and remove unnecessary privileged group membership

How the Test Works

This test counts user objects where the AdminCount attribute equals 1.

Related Tests

• Test-MtAdUserNonStandardPrimaryGroupCount - Finds users with unusual group membership baselines
• Test-MtAdUserSpnSetCount - Identifies potentially high-value service accounts

Details

Every attribute of this check

Field	Value
Test ID	AD-USER-11
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Users
Area	Privileged access
Resource type	User
MITRE ATT&CK	None
PowerShell test	Test-MtAdUserAdminCountCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:user:ReadProperty

Source

• Test: tests/ad/user/Test.AD-USER-11.ps1
• Documentation: tests/ad/user/Test.AD-USER-11.md