AD-USER-04: Reversible encryption user count should be retrievable
| ID | AD-USER-04 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1556.005 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Reversible password encryption is effectively equivalent to storing passwords in a decryptable form. Accounts configured this way create serious exposure if the directory or credential material is compromised.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”Disable reversible password encryption unless it is required for a documented legacy dependency that cannot be modernized immediately. Remediate those dependencies as a priority.
How the Test Works
Section titled “How the Test Works”This test retrieves Active Directory user data from Get-MtADDomainState and counts accounts with reversible-encryption-style indicators. It checks explicit reversible encryption properties when available and falls back to the relevant userAccountControl flag.
Related Tests
Section titled “Related Tests”Test-MtAdUserKerberosDesOnlyCountTest-MtAdUserPasswordNotRequiredCountTest-MtAdUserNoPreAuthCount
Related links
Section titled “Related links”- Microsoft Defender for Identity: Unsecure account attributes
- ANSSI Active Directory checkpoints: Privileged accounts with passwords stored using reversible encryption
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.