| name | performing-service-account-audit |
| description | Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud pl |
| domain | cybersecurity |
| subdomain | identity-access-management |
| tags | ["iam","identity","access-control","service-accounts","audit","governance"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"] |
Performing Service Account Audit
Overview
Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud platforms, databases, and applications, assessing privilege levels, identifying missing owners, and enforcing lifecycle policies.
When to Use
- When conducting security assessments that involve performing service account audit
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Coverage Gaps & Validation
- AD-only discovery: auditing service accounts only in Active Directory misses the majority. Enumerate Azure service principals/managed identities, AWS IAM users with access keys and roles, GCP service accounts and keys, database app-login accounts, and SaaS API keys/bot accounts.
- Identification by convention fails: filtering on a
svc- naming convention or a single OU misses service accounts that look like user accounts. Identify by behavior — SPN set, never used for interactive logon, non-expiring password, headless auth — not by name.
- Missing owners / orphans: accounts whose owning application was decommissioned keep working and keep their privilege. Reconcile each account to the CMDB/asset inventory; anything with no mapped application or owner is orphaned.
- Over-privilege and stale secrets: flag membership in Domain/cloud admin groups,
PasswordNeverExpires, and credentials older than the rotation policy (90 days).
- Validate completeness: reconcile the audited inventory against authoritative sources per platform (AD export, each cloud IAM, each database's login list) and against the application/CMDB inventory — accounts present in the platform but absent from your list are the audit gap. Verify dependencies are mapped before any disable action.
Prerequisites
- Familiarity with identity access management concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Objectives
- Discover all service accounts across AD, cloud, databases, and applications
- Identify orphaned accounts with no valid owner or associated application
- Assess privilege levels and flag over-privileged service accounts
- Check for non-rotating passwords and weak authentication
