AD-USER-24 - Built-in administrator last logon details should be investigated
Overview
Knowing when built-in administrator style accounts last authenticated is critical for detecting stale privileged access and spotting suspicious activity.
- Unexpected use detection: Recent logons on sensitive accounts may warrant investigation.
- Stale privilege cleanup: Dormant privileged accounts should be reviewed or disabled.
- Incident response: Last logon data helps reconstruct privileged account activity.
Control Type
Operational
Security Recommendation
- Investigate interactive or unexpected usage of RID 500 accounts.
- Disable or tightly restrict privileged accounts with no valid business need.
- Correlate recent logons with change windows, tickets, and admin workflows.
How the Test Works
This test lists built-in administrator style accounts and returns their LastLogonDate plus the number of days since the recorded logon.
Related Tests
Test-MtAdUserBuiltInAdminEnabledDetailsTest-MtAdUserBuiltInAdminPasswordAgeDetails
Test Metadata
| Field | Value |
|---|---|
| Test ID | AD-USER-24 |
| Severity | Info |
| Suite | Active Directory |
| Category | Active Directory - Users |
| PowerShell test | Test-MtAdUserBuiltInAdminLastLogonDetails |
| Services | ActiveDirectory |
| Tags | AD, AD-USER-24, AD.User |
Source
- Test:
tests/ad/user/Test.AD-USER-24.ps1 - Documentation:
tests/ad/user/Test.AD-USER-24.md