Service account retirement evidence workflow

Good For

• old domain service account cleanup

• pre-disable dependency discovery

• credential rotation and ownership review

• SPN and Kerberos dependency checks

• auditable disable-before-delete decisions

How to Use It

1. Establish an owner, business/application context, proposed retirement date, rollback owner, and observation window before deciding that absence of evidence means safe retirement.

2. Run the Service account usage finder across the in-scope Windows estate for services, scheduled tasks, and IIS assignments.

3. Extend configuration discovery to SQL Server services/jobs/proxies or credentials, automation runners, scripts/config files, credential stores, platform jobs, file/application mappings, CMDB, and secret-vault references available in the environment.

4. Review the AD object for SPNs, delegation-sensitive settings, owner clues, account metadata, groups, and directory dependencies; any unexplained SPN is a HOLD.

5. Collect runtime evidence from DC security logs, SIEM, or equivalent telemetry for successful/failed logons and Kerberos activity; LastLogonDate alone is not sufficient proof of inactivity.

6. Choose an observation window that spans the account's plausible cadence: daily jobs require days, monthly or quarterly jobs require the relevant cycle, and unknown cadence requires a conservative documented window.

7. DISABLE only when configuration discovery is reconciled, runtime evidence is quiet or understood, owners approve, and rollback monitoring is ready; HOLD when any dependency, authentication, SPN, owner, or cadence remains unexplained.

8. Disable before delete, record the exact disable time, monitor dependent services/jobs/authentication failures, and keep the object available for rapid re-enable.

9. ROLLBACK by re-enabling if a credible dependency fails, then capture that dependency before attempting retirement again.

10. Delete only after the disabled observation period completes without unresolved impact and retention/audit requirements are satisfied.

Execution Modes

• ad-filtered
• remote-host-list

Inputs and Outputs

Inputs

• service account
• server inventory
• AD read access
• DC security-log or SIEM authentication evidence
• SQL/automation/application owner inputs
• observation window
• change approval

Outputs

• operator-notes
• csv
• log-file

Command Starter

$Account = 'svc_legacyapp'
Get-ADUser -Identity $Account -Properties Enabled,LastLogonDate,ServicePrincipalName,Description,ManagedBy
# Review SPNs read-only through approved directory tooling or setspn -L; do not modify SPNs during discovery.
# Runtime/authentication evidence normally requires approved DC/security-log or SIEM access.
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4768,4769} -ErrorAction SilentlyContinue | Where-Object { $_.Message -match [regex]::Escape($Account) }
# Disable is a separate approved change after the evidence gate.
Disable-ADAccount -Identity $Account

Validation

• Configuration discovery covers Windows services, tasks, IIS, SQL/automation/scripts/stored credentials where available, and SPN/directory dependencies.

• Runtime authentication evidence is reviewed for an observation window appropriate to plausible cadence.

• A documented DISABLE or HOLD decision cites evidence rather than merely saying nothing was found.

• The account is disabled before deletion and the rollback path is operational.

• Post-disable monitoring covers authentication failures and known workload/service owners.

Reporting

• Maintain a dependency matrix with source, assignment, runtime evidence, owner, disposition, and confidence.

• Record the observation window and explicit DISABLE / HOLD rationale.

• Record disable timestamp, post-disable monitoring, rollback contact, and final delete approval separately.

Safety Notes

• Discovery is evidence-first; disabling the account is a separate approved change.

• Do not infer safe retirement from LastLogonDate or an empty service/task/IIS scan alone.

• Any unexplained SPN, authentication event, stored credential, owner uncertainty, or periodic workload is a HOLD.

• Disable before delete and keep a fast re-enable path during validation.