How can I identify and clean up unused or dormant accounts in Active Directory?
Attackers looking to break into your network love stale accounts that have been sitting patiently and quietly in Active Directory (AD). These accounts may be from users who have left the company, or have moved to other positions and no longer need the access granted by their old accounts. They can sit unnoticed by your system administrators until a hacker masquerading as an employee who just hasn't logged on in ages brings them back from the dead.
Performing regular audits of Active Directory will help you identify unused accounts. Once you find them, disable them to help lower the security risk. Unfortunately, that won't eliminate risk because even a disabled account can be revived by a determined intruder. However, Windows Server 2003 does have a command line tool, dsquery, and a GUI in the AD Users and Computers snap-in, that can locate all disabled users in a domain. Once found, you can delete these accounts, either manually or by writing a custom script.
For unused accounts that have not been disabled, the AD Users and Computers snap-in has a Saved Queries interface. You can look for accounts that haven't be active for a fixed number of days – a number that may already be defined in your IT security policy – and then either notify the errant users to see if they're still active, or simply delete them
- Keep your Active Directory domain user accounts in check.
- Learn how to delete Active Directory user certificates.
Dig Deeper on Privileged access management
Parents accuse Amazon of inaction in combatting child abuse material online
Coronavirus: Amazon warehouse workers strike over concerns about workplace safety and protections
Fighting fit: The ODI on courting startups to use open data to get the UK moving
Infinite io clusters its network storage controller
Related Q&A from Joel Dubin
Ensuring authenticity of online communications is critical to conduct business. Learn how to use a public key and private key in digital signatures ... Continue Reading
Learn about the purpose of CAPTCHA challenges that enable websites to differentiate bots from authentic users to stop spammers from hijacking forums ... Continue Reading
Proper planning is at the top of the list for single sign-on best practices, but it's important to get enterprise SSO implementations off to a good ... Continue Reading