AD-USER-25: Built-in administrator password age details should be investigated


ID	`AD-USER-25`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Users
Security area	Privileged access
Resource type	User
MITRE ATT&CK	T1078.001, T1110.003
Reads from	On-premises Active Directory

What this checks and how to fix it

Highly privileged accounts with old passwords are prime targets for password spraying, credential theft, and persistence. Reviewing password age for built-in administrator style accounts helps validate that sensitive credentials are rotated appropriately.

Credential risk reduction: Long-lived privileged passwords increase exposure.
Control validation: Supports verification of password rotation practices.
Exception tracking: Highlights accounts with non-expiring privileged credentials.

Control Type

Operational

Security Recommendation

Rotate passwords for privileged accounts on a defined schedule.
Avoid non-expiring passwords on privileged identities wherever possible.
Review break-glass or emergency accounts separately with compensating controls.

How the Test Works

This test lists built-in administrator style accounts and reports PasswordLastSet, calculated password age in days, and PasswordNeverExpires state.

Test-MtAdUserBuiltInAdminCount
Test-MtAdUserBuiltInAdminLastLogonDetails

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).