AD-USER-20: Known service account count should be retrievable
| ID | AD-USER-20 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Applications and workload identities |
| Resource type | User |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Many environments use recognizable naming conventions for service accounts such as svc_, service_, or _svc. These patterns make service accounts easier to inventory and harden.
- Service account inventory: Helps locate likely service identities quickly
- Hardening prioritization: Supports focused review of passwords, SPNs, and delegation
- Monitoring alignment: Makes it easier to target logon, privilege, and usage monitoring
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Review accounts matching known service account naming patterns for proper ownership and documentation
- Apply stronger controls to service accounts, including long random passwords and interactive logon restrictions
- Prefer managed service account options where the workload supports them
How the Test Works
Section titled “How the Test Works”This test counts user objects whose SamAccountName or Name matches common service account naming patterns such as svc_, service_, _svc, sa_, and similar variants.
Related Tests
Section titled “Related Tests”Test-MtAdUserSpnSetCount- Identifies service accounts through SPN usageTest-MtAdUserAdminCountCount- Highlights service accounts that may also be protected or privileged
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.