Does this sound familiar?
You decommission a server then months later you realize the accounts you setup to use with that server are still hanging around.
It’s super common that when a new system goes live, someone creates an account, adds it to a group, grants it access, and builds a workflow around it.
That access may have been appropriate for what the system needed at the time.
Then the application gets replaced. The server is decommissioned and you move onto the next IT project.
But did anybody think to remove the associated accounts and permissions?
I talked about this exact mistake on the Cyber Threat Perspective podcast.
It's one reason dangerous permissions pile up in Active Directory.
We add access as people and systems arrive.
When those people leave or systems change, the cleanup often gets skipped. Usually because we're busy IT people.
The problem is that AD doesn’t care if you remember or not.
An old service account may still sit in a security group.
A delegation may still let a group reset passwords, change membership, or write to an object.
If an attacker gets control of an identity with those rights, they get the rights too.
How serious that is depends on what the permission actually reaches.
IT admin action items:
Pick one retired system. Find the service accounts, security groups, and permissions that were created for it. Checking the ticketing system and the person who owned the application are good starting points to get more information.
Document the access that's still there. Check group membership and direct permissions in AD. Pay closest attention to rights over privileged and critical resources. For each, ask: is this access still needed?
Remove what no longer has a purpose or restrict where possible. Confirm the business owner and any remaining dependency first. Document the change, test it, and have a rollback plan. If the access is still needed, give it the smallest scope that works.
Don't turn this into a giant project to audit every permission at once. Start with the last system you retired. If you find an account or permission nobody can explain, your next step is to understand why.
The next time you decommission a system, make its identities and permissions part of the checklist. The work isn't done when the server is gone.
Check out my deep dive on these issues here: Cyber Threat Perspective episode 201.
All the best,
Spencer