What it does. Audit service accounts across enterprise infrastructure to identify orphaned, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-service-account-audit, or copy the skill folder into ~/.claude/skills/performing-service-account-audit/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-service-account-audit/SKILL.md

SKILL.md (verbatim)

name: performing-service-account-audit
description: Audit service accounts across enterprise infrastructure to identify orphaned,
  over-privileged, and non-compliant accounts. This skill covers discovery of service
  accounts in Active Directory, cloud pl
domain: cybersecurity
subdomain: identity-access-management
tags:
- iam
- identity
- access-control
- service-accounts
- audit
- governance
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.AA-01
- PR.AA-02
- PR.AA-05
- PR.AA-06
mitre_attack:
- T1078
- T1110
- T1556
- T1098
- T1069

Performing Service Account Audit

Overview

Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud platforms, databases, and applications, assessing privilege levels, identifying missing owners, and enforcing lifecycle policies.

When to Use

• When conducting security assessments that involve performing service account audit
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Familiarity with identity access management concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Discover all service accounts across AD, cloud, databases, and applications
• Identify orphaned accounts with no valid owner or associated application
• Assess privilege levels and flag over-privileged service accounts
• Check for non-rotating passwords and weak authentication
• Map service account dependencies for safe remediation
• Generate compliance reports for SOX, PCI DSS, and HIPAA audits

Key Concepts

Service Account Types

1. AD Service Accounts: Windows services, scheduled tasks, IIS app pools
2. Managed Service Accounts (gMSA): AD-managed automatic password rotation
3. Cloud IAM Service Accounts: AWS IAM roles/users, Azure service principals, GCP service accounts
4. Database Service Accounts: Application connection accounts, replication accounts
5. Application Service Accounts: API keys, bot accounts, integration accounts

Audit Dimensions

• Ownership: Who is responsible for this account?
• Purpose: What application/service uses this account?
• Privileges: What permissions does this account have?
• Authentication: How does this account authenticate (password, key, certificate)?
• Rotation: When was the credential last changed?
• Activity: When was this account last used?

Workflow

Step 1: Discovery - Active Directory

1. Query AD for all service accounts (filter by description, OU, naming convention)
2. Identify accounts with ServicePrincipalName set
3. List accounts in privileged groups (Domain Admins, Enterprise Admins)
4. Check for gMSA vs traditional service accounts
5. Identify accounts with PasswordNeverExpires flag

Step 2: Discovery - Cloud Platforms

• AWS: List IAM users with access keys, check last used date, identify unused roles
• Azure: Enumerate service principals, app registrations, managed identities
• GCP: List service accounts, check key age, identify unused permissions

Step 3: Assessment

• Flag accounts with admin/privileged group membership
• Check password age against rotation policy (90 days max)
• Identify accounts with no login activity in 90+ days
• Verify account ownership against CMDB/asset inventory
• Check for shared credentials (same password hash across accounts)

Step 4: Risk Classification

• Critical: Domain/cloud admin privileges, no password rotation
• High: Access to sensitive data, no identified owner
• Medium: Standard service permissions, password older than 90 days
• Low: Read-only access, managed credentials (gMSA, managed identity)

Step 5: Remediation

• Disable orphaned accounts after validation with application teams
• Convert traditional service accounts to gMSA where possible
• Rotate credentials older than policy threshold
• Reduce privileges to minimum required
• Assign owners and document dependencies

Security Controls

Common Pitfalls

• Disabling service accounts without verifying application dependencies first
• Not discovering service accounts outside of Active Directory
• Missing cloud service principals and managed identities
• Not checking for interactive logon rights on service accounts
• Failing to document dependencies before remediation

Verification

• Service accounts inventoried across all platforms
• Each account has assigned owner
• Privileged service accounts documented with justification
• Password rotation compliance checked
• Orphaned accounts flagged for remediation
• gMSA migration candidates identified
• Compliance report generated

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Service Account Audit Template

Service Account Inventory

Risk Classification

Remediation Tracking

Sign-Off

references/api-reference.md (verbatim)

API Reference: Service Account Audit

Active Directory PowerShell Cmdlets

AWS IAM CLI Commands

Azure CLI Commands

Risk Classification

Python Libraries

References

• NIST SP 800-53 AC-2: Account Management
• CIS Benchmark for Active Directory
• AWS IAM Best Practices: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
• Microsoft gMSA: https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview

references/standards.md (verbatim)

Standards - Service Account Audit

NIST Standards

• NIST SP 800-53 Rev 5: AC-2, AC-2(3), AC-6, IA-5, AU-6
• NIST SP 800-171: 3.1.1, 3.1.2, 3.5.1, 3.5.2

Industry Frameworks

• CIS Controls v8: Control 5.3 - Disable Dormant Accounts, Control 5.4 - Restrict Administrator Privileges
• MITRE ATT&CK: T1078 (Valid Accounts), T1136 (Create Account)
• PCI DSS 4.0: 7.2.5 - Review user access, 8.6 - Application/system account management
• SOX Section 404: Service account access controls for financial systems

Tools

• Microsoft AD: Get-ADServiceAccount, Get-ADUser with SPN filter
• AWS IAM: Access Analyzer, Credential Report, IAM Access Advisor
• Azure Entra ID: Service principal reports, App registration audit
• CyberArk DNA: Automated privileged account discovery
• Stealthbits (Netwrix): Service account discovery and monitoring

references/workflows.md (verbatim)

Service Account Audit Workflows

Workflow 1: Discovery Phase

1. Export AD service accounts using PowerShell/LDAP queries
2. Export cloud IAM service accounts (AWS credential report, Azure SP list, GCP SA list)
3. Query databases for application-specific service accounts
4. Consolidate into single inventory spreadsheet
5. Cross-reference with CMDB for ownership data

Workflow 2: Assessment Phase

1. Check each account against privilege policy
2. Verify password/key rotation compliance (90-day max)
3. Check last logon/activity date
4. Validate owner assignment against HR data
5. Flag accounts meeting orphaned/stale/over-privileged criteria

Workflow 3: Remediation Phase

1. Contact owners of over-privileged accounts for justification
2. Plan gMSA migration for eligible Windows service accounts
3. Disable orphaned accounts (staged: disable first, delete after 30 days)
4. Rotate stale credentials immediately
5. Update documentation, close findings, report to compliance

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.