AD-USER-16: User home directory count should be retrievable


ID	`AD-USER-16`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Users
Security area	Infrastructure hardening
Resource type	User
Reads from	On-premises Active Directory

What this checks and how to fix it

The HomeDirectory attribute points users to network-based storage locations. While useful in legacy environments, it can reveal older provisioning patterns and dependencies on file servers.

Legacy infrastructure visibility: Identifies users tied to mapped-drive style home folders
Access control review: Highlights centralized storage paths that may contain sensitive data
Modernization planning: Helps quantify remaining on-premises file service dependencies

Control Type

Detective

Security Recommendation

Review home directory locations for proper ACLs and ownership controls
Confirm the attribute is still required for active users
Retire obsolete mappings and legacy storage dependencies where feasible

How the Test Works

This test counts user objects where the HomeDirectory attribute contains a non-empty value.

Test-MtAdUserProfilePathCount - Finds roaming profile dependencies
Test-MtAdUserScriptPathCount - Identifies legacy logon automation

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).