Performing Service Account Audit

Performing Service Account Audit

Overview

Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud platforms, databases, and applications, assessing privilege levels, identifying missing owners, and enforcing lifecycle policies.

When to Use

• When conducting security assessments that involve performing service account audit
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Coverage Gaps & Validation

• AD-only discovery: auditing service accounts only in Active Directory misses the majority. Enumerate Azure service principals/managed identities, AWS IAM users with access keys and roles, GCP service accounts and keys, database app-login accounts, and SaaS API keys/bot accounts.
• Identification by convention fails: filtering on a svc- naming convention or a single OU misses service accounts that look like user accounts. Identify by behavior — SPN set, never used for interactive logon, non-expiring password, headless auth — not by name.
• Missing owners / orphans: accounts whose owning application was decommissioned keep working and keep their privilege. Reconcile each account to the CMDB/asset inventory; anything with no mapped application or owner is orphaned.
• Over-privilege and stale secrets: flag membership in Domain/cloud admin groups, PasswordNeverExpires, and credentials older than the rotation policy (90 days).
• Validate completeness: reconcile the audited inventory against authoritative sources per platform (AD export, each cloud IAM, each database's login list) and against the application/CMDB inventory — accounts present in the platform but absent from your list are the audit gap. Verify dependencies are mapped before any disable action.

Prerequisites

• Familiarity with identity access management concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Discover all service accounts across AD, cloud, databases, and applications
• Identify orphaned accounts with no valid owner or associated application
• Assess privilege levels and flag over-privileged service accounts
• Check for non-rotating passwords and weak authentication
• Map service account dependencies for safe remediation
• Generate compliance reports for SOX, PCI DSS, and HIPAA audits

Key Concepts

Service Account Types

1. AD Service Accounts: Windows services, scheduled tasks, IIS app pools
2. Managed Service Accounts (gMSA): AD-managed automatic password rotation
3. Cloud IAM Service Accounts: AWS IAM roles/users, Azure service principals, GCP service accounts
4. Database Service Accounts: Application connection accounts, replication accounts
5. Application Service Accounts: API keys, bot accounts, integration accounts

Audit Dimensions

• Ownership: Who is responsible for this account?
• Purpose: What application/service uses this account?
• Privileges: What permissions does this account have?
• Authentication: How does this account authenticate (password, key, certificate)?
• Rotation: When was the credential last changed?
• Activity: When was this account last used?

Workflow

Step 1: Discovery - Active Directory

1. Query AD for all service accounts (filter by description, OU, naming convention)
2. Identify accounts with ServicePrincipalName set
3. List accounts in privileged groups (Domain Admins, Enterprise Admins)
4. Check for gMSA vs traditional service accounts
5. Identify accounts with PasswordNeverExpires flag

Step 2: Discovery - Cloud Platforms

• AWS: List IAM users with access keys, check last used date, identify unused roles
• Azure: Enumerate service principals, app registrations, managed identities
• GCP: List service accounts, check key age, identify unused permissions

Step 3: Assessment

• Flag accounts with admin/privileged group membership
• Check password age against rotation policy (90 days max)
• Identify accounts with no login activity in 90+ days
• Verify account ownership against CMDB/asset inventory
• Check for shared credentials (same password hash across accounts)

Step 4: Risk Classification

• Critical: Domain/cloud admin privileges, no password rotation
• High: Access to sensitive data, no identified owner
• Medium: Standard service permissions, password older than 90 days
• Low: Read-only access, managed credentials (gMSA, managed identity)

Step 5: Remediation

• Disable orphaned accounts after validation with application teams
• Convert traditional service accounts to gMSA where possible
• Rotate credentials older than policy threshold
• Reduce privileges to minimum required
• Assign owners and document dependencies

Security Controls

Common Pitfalls

• Disabling service accounts without verifying application dependencies first
• Not discovering service accounts outside of Active Directory
• Missing cloud service principals and managed identities
• Not checking for interactive logon rights on service accounts
• Failing to document dependencies before remediation

Verification

• Service accounts inventoried across all platforms
• Each account has assigned owner
• Privileged service accounts documented with justification
• Password rotation compliance checked
• Orphaned accounts flagged for remediation
• gMSA migration candidates identified
• Compliance report generated