AD-USER-09 - Password-not-required user count should be retrievable

Contributed by Michael SouleAll contributors →

Overview

Accounts that do not require passwords are a severe security weakness. Even if rarely used, they represent a misconfiguration that can undermine core authentication protections.

Control Type

Detective

Security Recommendation

Investigate every account with PasswordNotRequired set. Require passwords, rotate credentials, and validate that no workflow depends on this unsafe configuration.

How the Test Works

This test retrieves Active Directory user data from Get-MtADDomainState and counts accounts where PasswordNotRequired = $true. The output shows the total count and percentage of affected users.

Related Tests

• Test-MtAdUserPasswordNeverExpiresCount
• Test-MtAdUserNoPreAuthCount
• Test-MtAdUserReversibleEncryptionCount

Test Metadata

Field	Value
Test ID	AD-USER-09
Severity	Info
Suite	Active Directory
Category	Active Directory - Users
PowerShell test	Test-MtAdUserPasswordNotRequiredCount
Services	ActiveDirectory
Tags	AD, AD-USER-09, AD.User

Source

• Test: tests/ad/user/Test.AD-USER-09.ps1
• Documentation: tests/ad/user/Test.AD-USER-09.md