AD-USER-09: Password-not-required user count should be retrievable
| ID | AD-USER-09 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1078.002 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Accounts that do not require passwords are a severe security weakness. Even if rarely used, they represent a misconfiguration that can undermine core authentication protections.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”Investigate every account with PasswordNotRequired set. Require passwords, rotate credentials, and validate that no workflow depends on this unsafe configuration.
How the Test Works
Section titled “How the Test Works”This test retrieves Active Directory user data from Get-MtADDomainState and counts accounts where PasswordNotRequired = $true. The output shows the total count and percentage of affected users.
Related Tests
Section titled “Related Tests”Test-MtAdUserPasswordNeverExpiresCountTest-MtAdUserNoPreAuthCountTest-MtAdUserReversibleEncryptionCount
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.