Built-in administrator password age details should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Users · All checks

Run this check

Invoke-Maester -TestId AD-USER-25

Overview

Highly privileged accounts with old passwords are prime targets for password spraying, credential theft, and persistence. Reviewing password age for built-in administrator style accounts helps validate that sensitive credentials are rotated appropriately.

• Credential risk reduction: Long-lived privileged passwords increase exposure.
• Control validation: Supports verification of password rotation practices.
• Exception tracking: Highlights accounts with non-expiring privileged credentials.

Control Type

Operational

Security Recommendation

• Rotate passwords for privileged accounts on a defined schedule.
• Avoid non-expiring passwords on privileged identities wherever possible.
• Review break-glass or emergency accounts separately with compensating controls.

How the Test Works

This test lists built-in administrator style accounts and reports PasswordLastSet, calculated password age in days, and PasswordNeverExpires state.

Related Tests

• Test-MtAdUserBuiltInAdminCount
• Test-MtAdUserBuiltInAdminLastLogonDetails

Details

Every attribute of this check

Field	Value
Test ID	AD-USER-25
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Users
Area	Privileged access
Resource type	User
MITRE ATT&CK	T1078.001 Default Accounts, T1110.003 Password Spraying
PowerShell test	Test-MtAdUserBuiltInAdminPasswordAgeDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:user:ReadProperty

Source

• Test: tests/ad/user/Test.AD-USER-25.ps1
• Documentation: tests/ad/user/Test.AD-USER-25.md