# Honey pot user count should be investigated

Accounts with names that look especially attractive to attackers can be useful as deliberate decoys, but they can also reflect risky naming practices or…

Source: https://maester.dev/docs/tests/AD-USER-26

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Users · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-USER-26
```

## Overview

Accounts with names that look especially attractive to attackers can be useful as deliberate decoys, but they can also reflect risky naming practices or forgotten identities that warrant review.

- **Threat detection support**: Decoy-style names can be monitored for malicious interaction.
- **Naming hygiene**: Identifies user names likely to draw attacker attention.
- **Access review**: Confirms whether these accounts are intentional and documented.

#### Control Type

**Operational**

#### Security Recommendation

- Document whether identified accounts are real users, service accounts, or deception assets.
- Apply strong monitoring to any deliberate honey pot or lure account.
- Disable or clean up misleading accounts that no longer serve a purpose.

#### How the Test Works

This test counts non-system user accounts whose names match attractive terms such as `admin`, `root`, `test`, `backup`, or `sql`.

#### Related Tests

- `Test-MtAdUserHoneyPotDetails`
- `Test-MtAdUserBuiltInAdminEnabledDetails`

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-USER-26 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Users |
| Area | Logging and detection |
| Resource type | User |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdUserHoneyPotCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-26.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |

</details>

## Source

- Test: [`tests/ad/user/Test.AD-USER-26.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-26.ps1)
- Documentation: [`tests/ad/user/Test.AD-USER-26.md`](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-26.md)