A service account is a non-personal account that an application, service or process uses to access resources, instead of a person. It lets software run, connect to databases, call other services and carry out tasks without anyone signing in.

What are service accounts used for?

• Running services and scheduled tasks.
• Connecting an application to a database or another service.
• Integrations between systems.
• Backup, monitoring and management tools.
• Automation and pipelines.

What types of service account are there?

• Local service accounts on a single machine.
• Domain service accounts used across a Windows domain.
• Managed service accounts, whose passwords the system rotates.
• Cloud service accounts and application identities in cloud platforms.

Why are service accounts a security risk?

• They often hold broad, long-lived rights.
• They cannot use MFA.
• Their passwords often never change.
• Nobody owns them, so nobody notices when they change.
• One account may be shared across several systems.
• Removing them risks breaking applications, so they stay.

How do attackers target service accounts?

Through Kerberoasting, which recovers their passwords offline, by finding credentials in scripts and configuration files, by using them for lateral movement and by abusing the excessive rights they hold. Because their activity looks automated, misuse is hard to notice.

How is a service account different from a user account?

A user account belongs to a person, who can be asked to use MFA, who joins, moves and leaves and whose behaviour varies. A service account belongs to software, runs in a repeatable pattern and has no natural owner unless one is assigned.

What does a service account incident look like?

A backup account created years ago has domain administrator rights and a password that has never changed. An attacker cracks it offline and signs in. The account starts connecting to servers it has never touched, at times it never ran, and because it is a service account, nobody is surprised to see it active.

What are the warning signs?

• Interactive logins by an account meant for services.
• Sign-ins from machines it never uses.
• Activity outside its normal schedule.
• Access to systems or data it never used before.
• A sudden rise in failed logins.

How is a service account different from a shared account?

A shared account is used by several people, which makes it impossible to say who did what. A service account is used by software. Both are risky when ungoverned, but they need different fixes: one needs individual accountability, the other needs an owner and a narrow scope.

Why block interactive logon?

Interactive logon means signing in at a keyboard or through remote desktop. A service account has no reason to do that, so allowing it only gives attackers a way to use the account like a normal user. Blocking it turns any such login into a clear warning sign.

What happens when the owner leaves?

Without a clear owner, the account is orphaned. Nobody knows what depends on it, so nobody dares to change or remove it, and it persists with the same rights. Every service account needs an owner who can be reached.

How do you manage service accounts?

• Keep an inventory, with an owner and a purpose for each.
• Use one account per application.
• Give each one only the rights it needs.
• Block interactive logon where it is not needed.
• Use long, random passwords, or managed accounts that rotate automatically.
• Rotate or retire credentials when systems change.

What is a managed service account?

An account whose password is generated and rotated by the system, so nobody knows or chooses it. It removes the weakest link, which is a password set once and never changed.

How do service accounts relate to non-human identities?

They are one kind of non-human identity, alongside API keys, tokens and AI agents. The same discipline applies to all of them: an owner, a narrow scope and monitoring.

Sharelock maps service accounts, their privileges and their age, and watches how they behave, so a service account that starts acting unlike its normal pattern stands out.

‍