AD-USER-19: User in container count should be retrievable

Not run by Mito

This check reads an on-premises Active Directory forest. Mito assesses your Microsoft 365 tenant in the cloud and does not run it. It is listed for reference only.

ID	AD-USER-19
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Users
Security area	Infrastructure hardening
Resource type	User
Reads from	On-premises Active Directory

What this checks and how to fix it

Users are easier to manage when placed in organizational units (OUs) that align to administration, policy, and lifecycle requirements. Accounts stored in container paths such as CN=Users often indicate default placement or limited organizational structure.

• Delegation limitations: Containers are less flexible for delegated administration
• Policy design impact: OUs are the preferred structure for policy and lifecycle management
• Default placement visibility: Helps identify accounts still living in CN=Users or similar container paths

Control Type

Detective

Security Recommendation

• Move standard user accounts from container paths into appropriate OUs
• Define an OU model that supports administration, policy, and lifecycle requirements
• Regularly review new accounts for default or non-standard placement

How the Test Works

This test counts user objects whose distinguished names indicate they are beneath a container path, including accounts under CN=Users.

Related Tests

• Test-MtAdUserManagerSetCount - Helps assess whether organizational metadata is mature enough for governance
• Test-MtAdUserKnownServiceAccountCount - Finds service accounts that may also require dedicated OUs

---

Mito check. Author: soulemike. Open-source licences.