Known service account count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Users · All checks

Run this check

Invoke-Maester -TestId AD-USER-20

Overview

Many environments use recognizable naming conventions for service accounts such as svc_, service_, or _svc. These patterns make service accounts easier to inventory and harden.

• Service account inventory: Helps locate likely service identities quickly
• Hardening prioritization: Supports focused review of passwords, SPNs, and delegation
• Monitoring alignment: Makes it easier to target logon, privilege, and usage monitoring

Control Type

Detective

Security Recommendation

• Review accounts matching known service account naming patterns for proper ownership and documentation
• Apply stronger controls to service accounts, including long random passwords and interactive logon restrictions
• Prefer managed service account options where the workload supports them

How the Test Works

This test counts user objects whose SamAccountName or Name matches common service account naming patterns such as svc_, service_, _svc, sa_, and similar variants.

Related Tests

• Test-MtAdUserSpnSetCount - Identifies service accounts through SPN usage
• Test-MtAdUserAdminCountCount - Highlights service accounts that may also be protected or privileged

Details

Every attribute of this check

Field	Value
Test ID	AD-USER-20
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Users
Area	Applications and workload identities
Resource type	User
MITRE ATT&CK	None
PowerShell test	Test-MtAdUserKnownServiceAccountCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:user:ReadProperty

Source

• Test: tests/ad/user/Test.AD-USER-20.ps1
• Documentation: tests/ad/user/Test.AD-USER-20.md