AD-FEAT-02: Optional feature enabled details should be investigated


ID	`AD-FEAT-02`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Directory configuration
Security area	Infrastructure hardening
Resource type	Tenant
Reads from	On-premises Active Directory

What this checks and how to fix it

Understanding which Active Directory optional features are enabled and their scope is crucial for security management:

Recycle Bin: Should be enabled at the forest level for object recovery capabilities
Privileged Access Management: May be enabled for specific domains or the entire forest
Feature Scope: Knowing where features are enabled helps ensure consistent security policies

Enabled optional features represent additional capabilities that can enhance security but also increase the attack surface if not properly managed.

Operational

Enable Recycle Bin at the forest level if not already enabled
Document all enabled optional features and their scope
Regularly review enabled features to ensure they align with security requirements
Understand the implications of each enabled feature
Monitor for unauthorized enabling of optional features

This test retrieves detailed information about enabled optional features:

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).