Built-in administrator last logon details should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Users · All checks

Run this check

Invoke-Maester -TestId AD-USER-24

Overview

Knowing when built-in administrator style accounts last authenticated is critical for detecting stale privileged access and spotting suspicious activity.

• Unexpected use detection: Recent logons on sensitive accounts may warrant investigation.
• Stale privilege cleanup: Dormant privileged accounts should be reviewed or disabled.
• Incident response: Last logon data helps reconstruct privileged account activity.

Control Type

Operational

Security Recommendation

• Investigate interactive or unexpected usage of RID 500 accounts.
• Disable or tightly restrict privileged accounts with no valid business need.
• Correlate recent logons with change windows, tickets, and admin workflows.

How the Test Works

This test lists built-in administrator style accounts and returns their LastLogonDate plus the number of days since the recorded logon.

Related Tests

• Test-MtAdUserBuiltInAdminEnabledDetails
• Test-MtAdUserBuiltInAdminPasswordAgeDetails

Details

Every attribute of this check

Field	Value
Test ID	AD-USER-24
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Users
Area	Privileged access
Resource type	User
MITRE ATT&CK	T1078.001 Default Accounts
PowerShell test	Test-MtAdUserBuiltInAdminLastLogonDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:user:ReadProperty

Source

• Test: tests/ad/user/Test.AD-USER-24.ps1
• Documentation: tests/ad/user/Test.AD-USER-24.md