AD-USER-26: Honey pot user count should be investigated
| ID | AD-USER-26 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Logging and detection |
| Resource type | User |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Accounts with names that look especially attractive to attackers can be useful as deliberate decoys, but they can also reflect risky naming practices or forgotten identities that warrant review.
- Threat detection support: Decoy-style names can be monitored for malicious interaction.
- Naming hygiene: Identifies user names likely to draw attacker attention.
- Access review: Confirms whether these accounts are intentional and documented.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Document whether identified accounts are real users, service accounts, or deception assets.
- Apply strong monitoring to any deliberate honey pot or lure account.
- Disable or clean up misleading accounts that no longer serve a purpose.
How the Test Works
Section titled “How the Test Works”This test counts non-system user accounts whose names match attractive terms such as admin, root, test, backup, or sql.
Related Tests
Section titled “Related Tests”Test-MtAdUserHoneyPotDetailsTest-MtAdUserBuiltInAdminEnabledDetails
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.