AD-CFG-04 - Optional features count should be retrievable
Overview
Active Directory optional features (and related feature flags) enable or enhance behaviors such as recoverability and directory management capabilities. Incorrectly enabled/disabled features can materially affect your security posture by:
- Reducing your ability to recover from accidental or malicious deletion
- Leaving legacy behaviors in place longer than necessary
- Causing operational drift that attackers can exploit via misconfiguration
In particular, features that improve recovery (such as those related to the Recycle Bin) directly impact resilience during incidents.
Control Type
Operational
Security Recommendation
- Ensure critical recoverability features (notably Recycle Bin) are enabled for the partitions that contain important identity data.
- Treat optional feature changes as security configuration changes: use a change control process, test first, and validate after enabling/disabling.
- Keep optional feature configuration consistent across domains/partitions where required.
How the Test Works
This test retrieves the set of enabled AD optional feature flags and reports them as a count/visibility metric so administrators can confirm whether the expected security-enhancing features are active.
Related Tests
Test-MtAdRecycleBinEnabledPaths- Shows where Recycle Bin is enabled.Test-MtAdRecycleBinStatus- Validates the Recycle Bin state.
Test Metadata
| Field | Value |
|---|---|
| Test ID | AD-CFG-04 |
| Severity | Info |
| Suite | Active Directory |
| Category | AD.Config |
| PowerShell test | Test-MtAdOptionalFeaturesCount |
| Tags | AD, AD-CFG-04, AD.Config |
Source
- Pester test:
tests/ad/config/Test-MtAdOptionalFeaturesCount.Tests.ps1 - PowerShell source:
powershell/public/ad/config/Test-MtAdOptionalFeaturesCount.ps1