service accounts

Service Account Design in Architecture (gMSAs, SPNs, Delegation, and Real-World Patterns) Service accounts are rarely “just accounts.” They’re long-lived identities that sit at the junction of authentication (Kerberos vs NTLM), authorization (AD ACLs), and operational reliability. That combination makes them both critical and dangerous: …

Self-Service Password Reset Integration with Active Directory (AD) Self-service password reset (SSPR) reduces helpdesk tickets, improves user productivity, and shortens recovery time during lockouts or forgotten passwords. The integration challenge is simple: users want one reset experience, while organizations still rely on on-premises Active Directory Domain Services (AD DS)…

Removing “Password Never Expires” Accounts in Active Directory The “Password never expires” setting (the DONT_EXPIRE_PASSWORD userAccountControl flag) is one of those legacy conveniences that quietly turns into a long-term security and compliance problem. This article shows how to find these accounts, decide what “good” looks like per account type, and remove the…

Ensuring Compliance for Dormant and Shared Accounts Dormant accounts and shared accounts are two of the most common identity-control gaps in Active Directory and hybrid environments. They create audit findings because they weaken accountability (who did what?) and increase attack surface (stale credentials, over-permissioning, and silent…

Aging Analysis of User Accounts A first-principles approach to reducing access risk, cleaning identity sprawl, and improving audit readiness. What “aging analysis” means: Aging analysis is the practice of classifying user accounts by time-based signals (e.g., last sign-in, last password change, time since creation, and time since last entitlement…

Detecting unmanaged accounts via group audit: advanced comparison guide for AD, Entra, SIEM, and PAM Detecting unmanaged accounts via group audit means using group membership changes and “who got added where” telemetry to surface identities that operate outside expected governance: accounts not onboarded to PAM, not tied to HR/ITSM ownership, not covered by standard…

1) What is a “shadow admin” in AD? A shadow admin is any user, group, or service principal that can achieve admin outcomes—such as modifying privileged group membership, controlling GPOs, resetting admin credentials, or replicating directory secrets—without being a direct member of obvious privileged groups. Why they’re hard to spot They hide in structure…

AD Honeypots and Decoy Accounts: Practical Deception for High-Signal Detection A practical guide to building high-signal deception inside Active Directory: decoy users, computers, groups, SPNs, and ACL “tripwires” that trigger alerts when an attacker enumerates, Kerberoasts, moves laterally, or attempts privilege escalation. …