From the Field: Service Accounts

🔎𝗙𝗿𝗼𝗺 𝘁𝗵𝗲 𝗙𝗶𝗲𝗹𝗱: Real-World Findings from Security Assessments

💥𝟲𝟲.𝟳% of infrastructures I analyzed 𝘂𝘀𝗲 𝗯𝗮𝘀𝗶𝗰 𝗱𝗼𝗺𝗮𝗶𝗻 𝘂𝘀𝗲𝗿 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀 𝗮𝘀 𝘀𝗲𝗿𝘃𝗶𝗰𝗲 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀.

This is one of the most widespread — and dangerous — misconfigurations I encounter.

𝗪𝗵𝘆? Because these accounts are usually:

❌ Old and unmanaged

❌ Have weak or never-rotated passwords

❌ Registered with SPNs = juicy Kerberoasting targets

❌ Sometimes even have admin or domain admin privileges

I get it — a new app or system goes live, someone needs a service account… and nobody knows the requirements. So they take the easy route: “Just create a regular user account and give it rights.”

𝗕𝘂𝘁 𝘄𝗲 𝗵𝗮𝘃𝗲 𝗯𝗲𝘁𝘁𝗲𝗿 𝗼𝗽𝘁𝗶𝗼𝗻𝘀 𝗻𝗼𝘄:

✅ Virtual Service Accounts (VSA)

✅ Group Managed Service Accounts (gMSA)

✅ Delegated Managed Service Accounts (DMSA) — my favorite, especially for migrating from basic accounts.

𝗜𝗳 𝘆𝗼𝘂 𝗮𝗯𝘀𝗼𝗹𝘂𝘁𝗲𝗹𝘆 𝗺𝘂𝘀𝘁 use a basic user account, secure it:

🔒 Strong, rotated password

🔒 Scoped access

🔒 Delegated permissions

🔒 Tiering compliance

💬 Do you still have basic user accounts running critical services in your environment?