AD-USER-11: User AdminCount count should be retrievable
| ID | AD-USER-11 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Privileged access |
| Resource type | User |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”The AdminCount attribute is commonly set on protected and privileged accounts. These users often inherit AdminSDHolder protections and may retain elevated access or restricted ACL inheritance.
- Privilege visibility: Highlights accounts that may be administrative or formerly administrative
- Delegation impact: Protected accounts behave differently from standard users
- Security review: Helps identify users that warrant stronger monitoring and change control
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Review each account with
AdminCount = 1to confirm it still requires elevated protections - Validate that privileged accounts are intentionally assigned and documented
- Investigate stale or unexpected protected users and remove unnecessary privileged group membership
How the Test Works
Section titled “How the Test Works”This test counts user objects where the AdminCount attribute equals 1.
Related Tests
Section titled “Related Tests”Test-MtAdUserNonStandardPrimaryGroupCount- Finds users with unusual group membership baselinesTest-MtAdUserSpnSetCount- Identifies potentially high-value service accounts
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.