Skip to content
MitoMito Docs

AD-DCOMP-06: No enabled computers should be stale for 180 days or more
ID AD-DCOMP-06
Severity Medium
Suite Active Directory (on-premises)
Product Active Directory
Feature Computers
Security area Identity lifecycle and hygiene
Resource type Computer
User impact of fixing Low
Effort to fix Medium
Framework controls nist-800-53-r5:AC-2(3) Account Management | Disable Accounts
MITRE ATT&CK T1078.002
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Stale enabled computer accounts represent a significant security risk in Active Directory. These are computer accounts that remain enabled but have not authenticated to the domain for an extended period (typically 180 days or more).

Security Risks:

  • Attack Vector: Stale accounts can be compromised and reactivated by attackers
  • Lateral Movement: Compromised stale accounts provide footholds for lateral movement
  • Credential Theft: May have weak or unchanged passwords
  • Shadow IT: May indicate forgotten or unauthorized systems
  • Compliance Issues: Violates security policies requiring regular account review

Common Causes:

  • Decommissioned systems that were never disabled
  • Virtual machines that were deleted but not removed from AD
  • Test systems that are no longer in use
  • Hardware refreshes where old accounts remain

Control Type

Section titled “Control Type”

Detective

Security Recommendation

Section titled “Security Recommendation”

  1. Regular Review Process:

    • Quarterly review of stale enabled computers
    • Document business justification for exceptions
    • Automate detection and reporting

  2. Remediation Actions:

    • Disable computers after 90-180 days of inactivity
    • Delete disabled computers after additional review period
    • Verify with system owners before deletion

  3. Preventive Measures:

    • Implement automated provisioning/deprovisioning
    • Use computer account lifecycle management
    • Regular audits of computer account creation

How the Test Works

Section titled “How the Test Works”

This test identifies enabled computers that:

  • Have never logged on, OR
  • Have not logged on for 180+ days

Provides counts and lists affected computers.

Section titled “Related Tests”
  • Test-MtAdComputerDormantCount - Dormant computer identification
  • Test-MtAdComputerDisabledCount - Disabled computer analysis
  • Test-MtAdUserDormantEnabledCount - Stale user account check
Section titled “Related links”

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.