Dormant accounts have been removed from sensitive Active Directory groups

Overview

Dormant accounts (accounts that have not authenticated for an extended period — Microsoft Defender for Identity’s posture assessment uses 180 days by default) that remain members of sensitive groups (Domain Admins, Enterprise Admins, Account Operators, Server Operators, Backup Operators, and any customer-tagged Tier-0 group) are high-value, low-attention targets: their owners are not actively monitoring sign-ins for anomalous activity, password rotations are unlikely, and any pre-existing credential leak (paste sites, third-party breach corpora, old endpoint backups) remains exploitable. A threat actor who obtains such a credential through credential stuffing or breach-data lookup authenticates as a Domain Admin or equivalent without triggering the behavioral baselines that protect active privileged users; from there they can replicate the directory’s secrets, forge long-lived authentication artifacts, and pivot to full forest compromise — all paths that begin with one stale, over-privileged identity. Removing dormant principals from sensitive groups — surfaced by MDI’s “Remove dormant accounts from sensitive groups” posture assessment — eliminates the latent privilege without disabling the underlying account, and is a prerequisite for any meaningful Tier-0 admin-tier-isolation strategy.

Remediation

• Remove dormant accounts from sensitive groups
• Microsoft Defender for Identity security posture assessments
• Protected accounts and groups in Active Directory

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Identity threat protection
Product	Active Directory
Feature	Groups
Area	Privileged access
ATT&CK	T1078.002 Domain Accounts
Licence	ATA
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.