AD-USER-27: Honey pot user details should be investigated
| ID | AD-USER-27 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Logging and detection |
| Resource type | User |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Detailed visibility into potential honey pot style users helps separate intentional deception assets from legacy, misleading, or risky accounts.
- Deception validation: Confirm lure accounts are intentional and monitored.
- Operational clarity: Distinguish test or stale accounts from active users.
- Risk reduction: Remove attractive-but-unnecessary account names.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Track owner and purpose for each identified account.
- Alert on any authentication attempts to intentional lure accounts.
- Disable or rename unnecessary accounts that imitate privileged or attractive targets.
How the Test Works
Section titled “How the Test Works”This test returns non-system users whose names match attacker-attractive terms and includes usage-oriented details such as enabled state, last logon, and password expiry status.
Related Tests
Section titled “Related Tests”Test-MtAdUserHoneyPotCountTest-MtAdUserKnownServiceAccountDetails
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.