AD-FEAT-01: Optional feature count should be investigated


ID	`AD-FEAT-01`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Directory configuration
Security area	Infrastructure hardening
Resource type	Tenant
Reads from	On-premises Active Directory

What this checks and how to fix it

Active Directory optional features extend the base functionality of AD and can significantly impact security capabilities:

Recycle Bin: Critical for recovering accidentally or maliciously deleted objects
Privileged Access Management (PAM): Enables time-based group membership for just-in-time access
Feature Awareness: Understanding available features helps assess security posture

Knowing which optional features are available helps administrators understand the full capabilities of their Active Directory environment and identify opportunities to enhance security.

Control Type

Operational

Security Recommendation

Enable the Active Directory Recycle Bin if not already enabled
Consider PAM for privileged access scenarios
Regularly review available optional features
Keep domain and forest functional levels current to access newer features
Document enabled optional features and their configuration

How the Test Works

This test retrieves all Active Directory optional features and counts:

Total number of optional features available
List of feature names

Test-MtAdOptionalFeatureEnabledDetails - Provides detailed information about enabled features
Test-MtAdRecycleBinStatus - Checks if the Recycle Bin is enabled

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).