Skip to main content
Version: 2.2.1-preview

AD-USER-20 - Known service account count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Many environments use recognizable naming conventions for service accounts such as svc_, service_, or _svc. These patterns make service accounts easier to inventory and harden.

  • Service account inventory: Helps locate likely service identities quickly
  • Hardening prioritization: Supports focused review of passwords, SPNs, and delegation
  • Monitoring alignment: Makes it easier to target logon, privilege, and usage monitoring

Security Recommendation​

  • Review accounts matching known service account naming patterns for proper ownership and documentation
  • Apply stronger controls to service accounts, including long random passwords and interactive logon restrictions
  • Prefer managed service account options where the workload supports them

How the Test Works​

This test counts user objects whose SamAccountName or Name matches common service account naming patterns such as svc_, service_, _svc, sa_, and similar variants.

  • Test-MtAdUserSpnSetCount - Identifies service accounts through SPN usage
  • Test-MtAdUserAdminCountCount - Highlights service accounts that may also be protected or privileged

Test Metadata​

FieldValue
Test IDAD-USER-20
SeverityInfo
SuiteActive Directory
CategoryAD.User
PowerShell testTest-MtAdUserKnownServiceAccountCount
TagsAD, AD-USER-20, AD.User

Source​

  • Pester test: tests/ad/user/Test-MtAdUserKnownServiceAccountCount.Tests.ps1
  • PowerShell source: powershell/public/ad/user/Test-MtAdUserKnownServiceAccountCount.ps1