search

EvotecIT / Testimo

Testimo is a PowerShell module for running health checks for Active Directory against a bunch of different tests
MIT License
519 stars 55 forks source link

Default account settings inconsistent #182

Closed ckalinwi closed 6 months ago

ckalinwi commented 6 months ago

Default account settings reads "Primary Group is always Domain Users with exception of Domain Guests" as OK, but then the check complains if users are in Domain Guests.

Which is correct? Thanks!

PrzemyslawKlys commented 6 months ago

Every single user in Active Directory should have Domain Users as default group. However user named 'Guest' or however it's named in other language domains should be Domain Guests.

Go to your AD and check that Guest user. Which group it has?

ckalinwi commented 6 months ago

The users in question are disabled and in the Domain Guests group (primary group ID 514) as opposed to the Domain Users group (primary group ID 513). That was done so that even if the user was willfully re-enabled they wouldn't have access to anything without them being re-added to the Domain Users group. If that's a finding according to best practices I can do it another way, I was just confused by the wording vs. the actual test.

PrzemyslawKlys commented 6 months ago

It's up to you what you do in your domain. The test does test the default settings and finds things outside of norm, but the recommendations are for you to choose. If you have a purpose in something and you believe it's how you want it - leave it, or tell Testimo to ignore it.