AD-USER-13: User SID History count should be retrievable
| ID | AD-USER-13 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Identity lifecycle and hygiene |
| Resource type | User |
| MITRE ATT&CK | T1134.005 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”SIDHistory is commonly used during migrations so users can retain access to resources secured with legacy SIDs. Long-term SID history can create unnecessary complexity and unintended access paths.
- Migration artifact detection: Identifies users that may still carry legacy identities
- Trust boundary review: Helps spot cross-domain access dependencies
- Permission cleanup: Supports least-privilege remediation after migrations
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Review users with
SIDHistoryto confirm ongoing business need - Remove unnecessary SID history entries after resource migration is complete
- Pay special attention to SIDs originating from external or less-trusted domains
How the Test Works
Section titled “How the Test Works”This test counts user objects where the SIDHistory attribute contains one or more values.
Related Tests
Section titled “Related Tests”Test-MtAdUserNonStandardPrimaryGroupCount- Finds other migration or provisioning anomaliesTest-MtAdUserAdminCountCount- Helps prioritize review of privileged accounts
Related links
Section titled “Related links”- Microsoft Defender for Identity: Unsecure SID History attributes
- ANSSI Active Directory checkpoints: Accounts or groups with SID history set
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.