AD-USER-23: Enabled built-in administrator details should be investigated
| ID | AD-USER-23 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Privileged access |
| Resource type | User |
| MITRE ATT&CK | T1078.001 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Enabled built-in administrator style accounts provide immediate opportunities for misuse if their credentials are exposed. A simple inventory of active accounts in this category helps confirm whether emergency or legacy access remains enabled unnecessarily.
- Exposure review: Enabled privileged accounts increase attack surface.
- Account validation: Confirms which sensitive accounts remain active.
- Operational control: Supports decisions to disable or tightly restrict use.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Disable built-in administrator accounts when not required.
- If they must remain enabled, restrict sign-in paths and monitor all usage.
- Ensure password rotation, MFA-equivalent controls, and break-glass procedures are documented.
How the Test Works
Section titled “How the Test Works”This test returns enabled user accounts that match the built-in administrator RID (-500) or are marked as critical system objects.
Related Tests
Section titled “Related Tests”Test-MtAdUserBuiltInAdminCountTest-MtAdUserBuiltInAdminLastLogonDetails
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.