AD-USER-18: User script path count should be retrievable
| ID | AD-USER-18 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Infrastructure hardening |
| Resource type | User |
| MITRE ATT&CK | T1037.003 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”The ScriptPath attribute can launch scripts automatically during user sign-in. These scripts may map drives, alter environment settings, or execute legacy administrative logic.
- Execution surface: Logon scripts can introduce code execution paths during authentication
- Legacy dependency detection: Helps identify environments still relying on older sign-in automation
- Review priority: Highlights scripts and shares that may need access hardening or modernization
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Review every configured logon script for business need and secure coding practices
- Protect the storage locations that host scripts from unauthorized modification
- Retire unnecessary scripts and move critical logic to managed modern tooling where possible
How the Test Works
Section titled “How the Test Works”This test counts user objects where the ScriptPath attribute contains a non-empty value.
Related Tests
Section titled “Related Tests”Test-MtAdUserHomeDirectoryCount- Identifies related legacy provisioning settingsTest-MtAdUserProfilePathCount- Finds users with additional sign-in infrastructure dependencies
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.