Skip to main content
Version: 2.2.1-preview

AD-USER-19 - User in container count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Users are easier to manage when placed in organizational units (OUs) that align to administration, policy, and lifecycle requirements. Accounts stored in container paths such as CN=Users often indicate default placement or limited organizational structure.

  • Delegation limitations: Containers are less flexible for delegated administration
  • Policy design impact: OUs are the preferred structure for policy and lifecycle management
  • Default placement visibility: Helps identify accounts still living in CN=Users or similar container paths

Security Recommendation​

  • Move standard user accounts from container paths into appropriate OUs
  • Define an OU model that supports administration, policy, and lifecycle requirements
  • Regularly review new accounts for default or non-standard placement

How the Test Works​

This test counts user objects whose distinguished names indicate they are beneath a container path, including accounts under CN=Users.

  • Test-MtAdUserManagerSetCount - Helps assess whether organizational metadata is mature enough for governance
  • Test-MtAdUserKnownServiceAccountCount - Finds service accounts that may also require dedicated OUs

Test Metadata​

FieldValue
Test IDAD-USER-19
SeverityInfo
SuiteActive Directory
CategoryAD.User
PowerShell testTest-MtAdUserInContainerCount
TagsAD, AD-USER-19, AD.User

Source​

  • Pester test: tests/ad/user/Test-MtAdUserInContainerCount.Tests.ps1
  • PowerShell source: powershell/public/ad/user/Test-MtAdUserInContainerCount.ps1