What are Stale Accounts in Active Directory?

Accounts that have not been used in the past six months and are no longer necessary. Stale accounts are often inactive user accounts. They are an account from a user who no longer works there that was never deactivated or they are an account that was created and forgotten about for some other reason.

According to Microsoft, over 10% of user accounts in Active Directory have been detected as inactive otherwise known as “stale”, based on the last time the password was changed or the user’s last logon timestamp.

Stale accounts in Active Directory can offer attackers, or even former employees, a straightforward route into an organization’s environment. Even if the inactive user account lacks privileges, it remains susceptible to exploitation in privilege escalation attacks.

Organizations must introduce the proper technical processes and department communication to remediate the risk of inactive accounts in Active Directory.

What can you do in Active Directory to eliminate the risk of stale accounts?

• Deactivate user accounts that have either never been logged into or have remained inactive for a specified duration.
• Strip group memberships from disabled accounts and transfer them to designated containers within Active Directory, such as a “disabled” Organizational Unit (OU), to enhance visibility and restrict access to resources.
• Remove obsolete accounts from the system.

How can Enzoic help with Stale Accounts in Active Directory?

Enzoic for Active Directory Lite tracks these accounts and reports on them to allow admins a chance to take action with those accounts or deprovision them.

Inactive, accounts can easily grant an attacker or former employee unauthorized access. Organizations should clean them up regularly to keep their environment more secure. To learn more about stale accounts and other critical risk factors for passwords in Active Directory, visit our blog: https://www.enzoic.com/blog/enzoic-for-ad-lite-data-2023/

The post Stale Accounts in Active Directory appeared first on Enzoic.

*** This is a Security Bloggers Network syndicated blog from Blog | Enzoic authored by Enzoic. Read the original post at: https://www.enzoic.com/blog/stale-accounts-in-active-directory/