Posture check · Workload and agent identity
Service account can log on interactively (T1078.002)
An enabled service account with a service principal name has no Log On To restriction, so it can log on at any computer in the domain. Group managed service accounts are excluded.
Why it matters
Anyone who learns the password of a service account can use it at a keyboard or over Remote Desktop on any computer, not only on the servers it runs on.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Active Directory.
It reads:
- The directory attributes
servicePrincipalName,userAccountControl,accountEnabled,objectClassanduserWorkstations
Tiered Fidelity™ level: Theoretical
Every finding from this check carries the Theoretical level.
- TheoreticalThis checkConfigured in the directory. Nothing else checked.
- ConstrainedA constraint on it has been checked.
- ValidatedTelemetry has seen it in use.
Why there's no automatic fix
No automated step sets the Log On To list or a deny logon right yet, so a person limits the account in Active Directory or in Group Policy.
How to fix it
Limit this service account to the computers it runs on with Log On To (userWorkstations), or deny it interactive logon by Group Policy.
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.