User profile path count should be retrievable
AD-USER-17InfoActive DirectoryUsers
Part of Active Directory · Active Directory · Users · All checks
Invoke-Maester -TestId AD-USER-17Overview
Section titled “Overview”The ProfilePath attribute is commonly associated with roaming profiles and centralized workstation state. It often points to legacy file server infrastructure that should be reviewed for resilience and access control.
- Legacy profile management: Identifies users depending on roaming profiles
- Data exposure review: Highlights centralized storage paths that may require tighter controls
- Operational dependency mapping: Helps quantify reliance on older desktop management models
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Review profile share permissions and access paths
- Confirm roaming profiles are still necessary for affected users
- Consider modern endpoint and profile management approaches where appropriate
How the Test Works
Section titled “How the Test Works”This test counts user objects where the ProfilePath attribute contains a non-empty value.
Related Tests
Section titled “Related Tests”Test-MtAdUserHomeDirectoryCount- Highlights related file share dependenciesTest-MtAdUserScriptPathCount- Finds additional legacy sign-in configuration
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-USER-17 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Users |
| Area | Infrastructure hardening |
| Resource type | User |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdUserProfilePathCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/user/Test.AD-USER-17.ps1 - Documentation:
tests/ad/user/Test.AD-USER-17.md