User script path count should be retrievable
AD-USER-18InfoActive DirectoryUsers
Part of Active Directory · Active Directory · Users · All checks
Invoke-Maester -TestId AD-USER-18Overview
Section titled “Overview”The ScriptPath attribute can launch scripts automatically during user sign-in. These scripts may map drives, alter environment settings, or execute legacy administrative logic.
- Execution surface: Logon scripts can introduce code execution paths during authentication
- Legacy dependency detection: Helps identify environments still relying on older sign-in automation
- Review priority: Highlights scripts and shares that may need access hardening or modernization
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Review every configured logon script for business need and secure coding practices
- Protect the storage locations that host scripts from unauthorized modification
- Retire unnecessary scripts and move critical logic to managed modern tooling where possible
How the Test Works
Section titled “How the Test Works”This test counts user objects where the ScriptPath attribute contains a non-empty value.
Related Tests
Section titled “Related Tests”Test-MtAdUserHomeDirectoryCount- Identifies related legacy provisioning settingsTest-MtAdUserProfilePathCount- Finds users with additional sign-in infrastructure dependencies
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-USER-18 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Users |
| Area | Infrastructure hardening |
| Resource type | User |
| MITRE ATT&CK | T1037.003 Network Logon Script |
| PowerShell test | Test-MtAdUserScriptPathCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/user/Test.AD-USER-18.ps1 - Documentation:
tests/ad/user/Test.AD-USER-18.md