Honey pot user details should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Users · All checks

Run this check

Invoke-Maester -TestId AD-USER-27

Overview

Detailed visibility into potential honey pot style users helps separate intentional deception assets from legacy, misleading, or risky accounts.

• Deception validation: Confirm lure accounts are intentional and monitored.
• Operational clarity: Distinguish test or stale accounts from active users.
• Risk reduction: Remove attractive-but-unnecessary account names.

Control Type

Operational

Security Recommendation

• Track owner and purpose for each identified account.
• Alert on any authentication attempts to intentional lure accounts.
• Disable or rename unnecessary accounts that imitate privileged or attractive targets.

How the Test Works

This test returns non-system users whose names match attacker-attractive terms and includes usage-oriented details such as enabled state, last logon, and password expiry status.

Related Tests

• Test-MtAdUserHoneyPotCount
• Test-MtAdUserKnownServiceAccountDetails

Details

Every attribute of this check

Field	Value
Test ID	AD-USER-27
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Users
Area	Logging and detection
Resource type	User
MITRE ATT&CK	None
PowerShell test	Test-MtAdUserHoneyPotDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:user:ReadProperty

Source

• Test: tests/ad/user/Test.AD-USER-27.ps1
• Documentation: tests/ad/user/Test.AD-USER-27.md