AD-USER-24: Built-in administrator last logon details should be investigated


ID	`AD-USER-24`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Users
Security area	Privileged access
Resource type	User
MITRE ATT&CK	T1078.001
Reads from	On-premises Active Directory

What this checks and how to fix it

Knowing when built-in administrator style accounts last authenticated is critical for detecting stale privileged access and spotting suspicious activity.

Unexpected use detection: Recent logons on sensitive accounts may warrant investigation.
Stale privilege cleanup: Dormant privileged accounts should be reviewed or disabled.
Incident response: Last logon data helps reconstruct privileged account activity.

Control Type

Operational

Security Recommendation

Investigate interactive or unexpected usage of RID 500 accounts.
Disable or tightly restrict privileged accounts with no valid business need.
Correlate recent logons with change windows, tickets, and admin workflows.

How the Test Works

This test lists built-in administrator style accounts and returns their LastLogonDate plus the number of days since the recorded logon.

Test-MtAdUserBuiltInAdminEnabledDetails
Test-MtAdUserBuiltInAdminPasswordAgeDetails

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).