Skip to content
MitoMito Docs

AD-COMP-03: Computer CreatorSid count should be retrievable
ID AD-COMP-03
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Computers
Security area Access control
Resource type Computer
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

The ms-ds-CreatorSid attribute identifies which security principal created a computer account. This is valuable for:

  • Audit trail: Understanding who or what created computer accounts helps trace unauthorized additions
  • Delegation analysis: Identifying service accounts or users with excessive computer creation rights
  • Security monitoring: Detecting unusual computer creation patterns that may indicate compromise
  • Compliance: Meeting requirements for tracking resource creation in the directory

Control Type

Section titled “Control Type”

Detective

Security Recommendation

Section titled “Security Recommendation”

Computer account creation should be tightly controlled:

  • Limit the ms-DS-MachineAccountQuota attribute (default is 10) to prevent standard users from creating computer accounts
  • Use dedicated service accounts for automated computer provisioning
  • Regularly audit computer accounts to identify those created by unexpected principals
  • Consider setting the quota to 0 and using pre-staged computer accounts or dedicated provisioning processes

How the Test Works

Section titled “How the Test Works”

This test counts computer objects that have the ms-ds-CreatorSid attribute populated. This attribute is typically set when:

  • A user or service account explicitly creates a computer account
  • The creating principal has been captured in the directory

Note: Not all computer accounts will have this attribute, depending on how they were created.

Section titled “Related Tests”
  • Test-MtAdComputerNonStandardGroup - Identifies computers with unusual primary group assignments
  • Test-MtAdComputerInDefaultContainer - Finds computers that may have been auto-created

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.