Why a forgotten service account is a risk
- High privileges: many service accounts were given broad permissions at some point, sometimes membership in groups like Domain Admins.
- Nobody notices: an account that doesn’t belong to a person doesn’t complain when something unusual happens on it.
- Old passwords: many service accounts don’t change their password for years.
According to Microsoft, a compromised account like this gives an attacker a quiet entry point into critical systems, and a way to move across the network undetected.
The relevant Defender for Identity assessments
| Assessment | What it lists |
|---|---|
| Remove stale service accounts (preview) | AD service accounts with no sign-in in the past 90 days |
| Dormant entities in sensitive groups | Sensitive users and service accounts unused for 180 days |
| Identify service accounts in privileged groups | Service accounts that are members of protected groups like Domain Admins, directly or nested |
| Service accounts with Domain Name Admin or Global Admin roles | Service accounts holding top-tier Entra ID admin roles |
| Remove stale Active Directory accounts (preview) | Regular user accounts with no sign-in for 90 days (added January 2026) |
You’ll find them in Microsoft Defender under Secure Score, Recommended actions. The list of accounts updates within minutes; scores and statuses update once a day.
How to clean up without breaking a service
- Disable first, don’t delete. Microsoft recommends disabling the account rather than deleting it straight away.
- Monitor for a few weeks. Look for service errors, failed sign-ins or an app that stopped working.
- Delete only once there’s no dependency. If nothing breaks, delete the account and remove its access.
- For an account you still need: take it out of protected groups, give it only the permissions it needs, and restrict where it can sign in.
- Replace legacy accounts with gMSA. Group Managed Service Accounts rotate their passwords automatically, which removes the risk of a password unchanged for years.
What you need to get these assessments
Defender for Identity works with sensors installed on your domain controllers, and in some environments also on AD FS and Entra Connect servers. The sensors analyze AD traffic and events and send them to the cloud, where the assessments and alerts are built. Without sensors, these assessments don’t appear.
At OnCloud we deploy Defender for Identity and help you clean up Active Directory: mapping service accounts, removing unneeded privileges and moving to gMSA without stopping services. Want to check where you stand?
Contact us