AD-USER-02: Dormant enabled user count should be retrievable
| ID | AD-USER-02 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Identity lifecycle and hygiene |
| Resource type | User |
| Framework controls | nist-800-53-r5:AC-2(3) Account Management | Disable Accounts |
| MITRE ATT&CK | T1078.002 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Enabled user accounts that have not logged on for more than 90 days are a common sign of weak identity hygiene. Forgotten but still-enabled accounts can retain access, group memberships, and password material that attackers may target.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”Investigate dormant enabled accounts and disable or remove those that are no longer needed. For exceptions such as break-glass or low-use service accounts, apply stronger controls and document ownership.
How the Test Works
Section titled “How the Test Works”This test retrieves Active Directory user data from Get-MtADDomainState, filters to enabled users, and counts accounts where LastLogonDate is older than 90 days. The output shows the number and percentage of dormant enabled users.
Related Tests
Section titled “Related Tests”Test-MtAdUserDisabledCountTest-MtAdUserNeverLoggedInCountTest-MtAdUserPasswordNeverExpiresCount
Related links
Section titled “Related links”- Microsoft Defender for Identity: Remove stale Active Directory accounts
- ANSSI Active Directory checkpoints: Dormant accounts
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.