Service accounts outlive the people who created them, hold standing privilege, and are excluded from the access reviews that cover humans. An account with no named owner and a password set four years ago is the one attackers look for.
Assign a human owner to every account. Not a team but a person, with a deputy. An account owned by 'Infrastructure' is owned by nobody when a decision is needed about whether it can be disabled.
Record what breaks if it is disabled. The reason orphaned service accounts persist is that nobody dares disable them. Documenting the dependency converts an unknown risk into a decision you can take.
Eliminate passwords where you can. Workload identity, managed identities, and certificate authentication remove the long-lived secret entirely. Prefer those over rotating passwords on a schedule.
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
| Account | Type | Purpose | Owner (person) | Deputy | Privilege level | Auth method | Credential last rotated | Interactive login possible | What breaks if disabled |
|---|---|---|---|---|---|---|---|---|---|
| svc-nightly-etl | Service | Nightly warehouse load | A. Mehta | Data lead | Read on source, write on warehouse | Managed identity | n/a | No | Warehouse data goes stale; reports show yesterday |
| svc-backup-agent | Service | Backup agent authentication | Infrastructure lead | SysAdmin | Backup operator | Certificate | 2026-06-01 | No | All backups fail |
More free templates IT teams use alongside this one.
An access review where every manager clicks approve is worse than no review, because it manufactures evidence that access was checked. This template is built to produce the two things auditors actually test: a named reviewer who attested, and proof that the revocations they asked for happened.
Access control policies state least privilege and then leave the mechanics unspecified, which is where it breaks down. This one fixes the approval route, the review cadence, and the privileged-access rules explicitly.
Most password policies still enforce 90-day rotation and complexity rules that current NIST guidance explicitly advises against, because they push people toward predictable patterns. This one follows the evidence: length, breach screening, and MFA.
The account, its type and purpose, a named human owner and deputy, privilege level, authentication method, credential age, whether interactive login is possible, and crucially what breaks if the account is disabled.
They hold standing privilege, rarely have credentials rotated, often permit interactive login unnecessarily, and are usually excluded from access reviews covering human users. An unowned one with a years-old password is a reliable attack path.
Trace dependencies through logs, scheduled tasks, connection strings and firewall rules; disable rather than delete; leave it disabled for about 30 days; then delete and revoke the credential if nothing broke.
