AD-USER-01: Disabled user count should be retrievable
| ID | AD-USER-01 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Identity lifecycle and hygiene |
| Resource type | User |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Disabled user accounts are expected during offboarding, investigations, and staged deprovisioning. Tracking their volume helps identify stale objects that should be deleted, reduces directory clutter, and supports lifecycle governance.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”Review disabled user accounts regularly and remove accounts that no longer need to exist. For retained accounts, document the business reason and expected retention period.
How the Test Works
Section titled “How the Test Works”This test retrieves cached Active Directory user data from Get-MtADDomainState and counts user objects where Enabled = $false. The result includes total, enabled, and disabled user counts plus the disabled percentage.
Related Tests
Section titled “Related Tests”Test-MtAdUserDormantEnabledCountTest-MtAdUserNeverLoggedInCountTest-MtAdUserPasswordNotRequiredCount
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.