Enabled built-in administrator details should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Users · All checks

Run this check

Invoke-Maester -TestId AD-USER-23

Overview

Enabled built-in administrator style accounts provide immediate opportunities for misuse if their credentials are exposed. A simple inventory of active accounts in this category helps confirm whether emergency or legacy access remains enabled unnecessarily.

• Exposure review: Enabled privileged accounts increase attack surface.
• Account validation: Confirms which sensitive accounts remain active.
• Operational control: Supports decisions to disable or tightly restrict use.

Control Type

Operational

Security Recommendation

• Disable built-in administrator accounts when not required.
• If they must remain enabled, restrict sign-in paths and monitor all usage.
• Ensure password rotation, MFA-equivalent controls, and break-glass procedures are documented.

How the Test Works

This test returns enabled user accounts that match the built-in administrator RID (-500) or are marked as critical system objects.

Related Tests

• Test-MtAdUserBuiltInAdminCount
• Test-MtAdUserBuiltInAdminLastLogonDetails

Details

Every attribute of this check

Field	Value
Test ID	AD-USER-23
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Users
Area	Privileged access
Resource type	User
MITRE ATT&CK	T1078.001 Default Accounts
PowerShell test	Test-MtAdUserBuiltInAdminEnabledDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:user:ReadProperty

Source

• Test: tests/ad/user/Test.AD-USER-23.ps1
• Documentation: tests/ad/user/Test.AD-USER-23.md