AD-USER-15: User manager count should be retrievable
| ID | AD-USER-15 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Identity lifecycle and hygiene |
| Resource type | User |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”The Manager attribute is frequently used in governance workflows, approval chains, and identity lifecycle processes. Missing or inconsistent manager data can weaken access review quality.
- Governance readiness: Supports manager-based approval and review processes
- Data quality insight: Shows how complete identity metadata is across the domain
- Operational control: Helps identify where HR or provisioning integrations may be incomplete
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Populate manager data for workforce identities where appropriate
- Validate synchronization from authoritative systems such as HR platforms
- Use complete manager relationships to strengthen approval and certification processes
How the Test Works
Section titled “How the Test Works”This test counts user objects where the Manager attribute contains a non-empty value.
Related Tests
Section titled “Related Tests”Test-MtAdUserHomeDirectoryCount- Highlights legacy user provisioning attributesTest-MtAdUserProfilePathCount- Identifies additional operational dependencies
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.