Service accounts are created once, with passwords nobody changes and more rights than necessary "so it works". Nobody feels responsible and they are rarely reviewed.
What has proven effective
Inventory: record all service accounts, purpose and owners.
Least privilege: only what the service needs, no domain admins.
Long random passwords or managed service accounts (gMSA) that rotate the password automatically.
Forbid interactive sign-in where possible.
Keep passwords in a vault, not in scripts or configuration files.
Monitoring: report unusual sign-ins of service accounts.
Clean up: disable and delete unused accounts.
Why it pays off
Well-managed service accounts prevent attacks such as Kerberoasting and limit damage if a service is compromised.
service accountsgMSAservice account passwordtechnical accounts
Frequently asked questions
What is a service account?
A technical account under which applications or services run without a person signing in.
What is a gMSA?
A group managed service account in Active Directory whose long password is managed automatically and changed regularly.
Why are service accounts risky?
They often have high rights, old passwords and are rarely reviewed.