AD-USER-04 - Reversible encryption user count should be retrievable

Contributed by Michael Soule with 2 co-contributorsAll contributors →

Overview

Reversible password encryption is effectively equivalent to storing passwords in a decryptable form. Accounts configured this way create serious exposure if the directory or credential material is compromised.

Control Type

Detective

Security Recommendation

Disable reversible password encryption unless it is required for a documented legacy dependency that cannot be modernized immediately. Remediate those dependencies as a priority.

How the Test Works

This test retrieves Active Directory user data from Get-MtADDomainState and counts accounts with reversible-encryption-style indicators. It checks explicit reversible encryption properties when available and falls back to the relevant userAccountControl flag.

Related Tests

• Test-MtAdUserKerberosDesOnlyCount
• Test-MtAdUserPasswordNotRequiredCount
• Test-MtAdUserNoPreAuthCount

Related links

• Microsoft Defender for Identity: Unsecure account attributes
• ANSSI Active Directory checkpoints: Privileged accounts with passwords stored using reversible encryption

Test Metadata

Field	Value
Test ID	AD-USER-04
Severity	Medium
Suite	Active Directory
Category	AD.User
PowerShell test	Test-MtAdUserReversibleEncryptionCount
Tags	AD, AD-USER-04, AD.User

Source

• Pester test: tests/ad/user/Test-MtAdUserReversibleEncryptionCount.Tests.ps1
• PowerShell source: powershell/public/ad/user/Test-MtAdUserReversibleEncryptionCount.ps1