skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

performing-service-account-audit

Audit service accounts across Active Directory, AWS, and Azure to flag orphaned and over-privileged accounts.

4|Updated Apr 28, 2026
Search Tags:#compliance#active directory#gmsa#service accounts#privileged access#aws iam#iam audit
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill performing-service-account-audit-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-service-account-audit
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/performing-service-account-audit
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill performing-service-account-audit-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve? Service accounts accumulate across Active Directory, cloud platforms, databases, and applications without centralized oversight, leaving organizations exposed to orphaned accounts, stale credentials, and excessive privileges that auditors and attackers both find first. ## Core Features & Use Cases - Cross-Platform Discovery: Enumerate service accounts in Active Directory via PowerShell/LDAP, AWS IAM users and access keys, and Azure service principals, consolidated into one inventory. - Risk Classification: Score accounts by privileged group membership, password age, PasswordNeverExpires flags, and logon activity into Critical/High/Medium/Low tiers. - Compliance Reporting: Generate findings mapped to NIST 800-53, PCI DSS, SOX, and HIPAA with remediation guidance for gMSA migration and credential rotation. - Use Case: Before a SOX audit, run the auditor against your domain and AWS account to produce a risk-ranked report showing which service accounts lack owners, exceed the 90-day password policy, or hold Domain Admin rights. ## Quick Start Ask the AI to audit service accounts in your Active Directory domain and AWS environment, then generate a risk-classified compliance report listing orphaned and over-privileged accounts.

Frequently Asked Questions about performing-service-account-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit service accounts in Active Directory?▼

Use PowerShell cmdlets like Get-ADUser with a ServicePrincipalName filter and Search-ADAccount to find accounts with SPNs, non-expiring passwords, and inactivity over 90 days. The included agent.py script automates this discovery and exports results as JSON.

How to find orphaned service accounts in AWS IAM?▼

List IAM users with the AWS CLI, filter names matching service patterns like svc or bot, then check access key age and last-used dates. Accounts with no recent activity and no documented owner are flagged as orphaned.

What makes a service account over-privileged?▼

Membership in groups like Domain Admins, Enterprise Admins, or Schema Admins makes a service account over-privileged. The auditor assigns risk weights to these groups and classifies accounts scoring 40 or higher as Critical.

Does this work with Azure and GCP service accounts?▼

The SKILL.md workflow covers Azure service principals and GCP service accounts using az ad sp list and GCP key age checks. The provided scripts implement AD and AWS discovery directly; Azure and GCP follow the documented manual workflow.

Why is Kerberoasting a risk for service accounts?▼

Accounts with ServicePrincipalNames allow attackers to request Kerberos tickets and crack password hashes offline. The audit flags SPN-bearing accounts and recommends 25+ character passwords or gMSA migration to mitigate this.

What are the limitations of automated service account discovery?▼

Discovery depends on naming conventions and SPN filters, so accounts outside AD or with nonstandard names may be missed. Application-level accounts and API keys require manual inventory or CMDB cross-referencing.

Related Skills

Explore More Legal & Compliance Skills→
xalgordxalgord
954

performing-service-account-audit

Audit service accounts across Active Directory, cloud platforms, and databases to identify orphaned and over-privileged accounts.

Community
Intermediate
xalgordxalgord
954

performing-service-account-credential-rotation

Automates credential rotation for service accounts across Active Directory, cloud platforms, and databases.

Community
Advanced
AcczdyAcczdy
2

implementing-pam-for-database-access

Implement privileged access management for Oracle, SQL Server, PostgreSQL, and MySQL databases.

Community
Intermediate
xalgordxalgord
954

implementing-zero-standing-privilege-with-cyberark

Deploy CyberArk Secure Cloud Access to replace standing privileges with just-in-time cloud access.

Community
Advanced