Lesson 2.1: Stale and risky accounts
Accounts outlive their owners. Former staff, test accounts and forgotten integrations stay enabled for years, often with old passwords that never expire, sometimes with the password written in the description field. Each one is a door nobody watches. In the lab you find enabled accounts with no logon for 90 days, accounts that don't even need a password, passwords left in descriptions, and passwords set never to expire, then disable what nobody uses and clean up the rest with ldapmodify.
17 min
You will learn to
- Find stale enabled accounts with lastLogonTimestamp
- Read userAccountControl flags for risky settings
- Find secrets in description fields
- Find never-expiring passwords
- Disable and document with ldapmodify
Key terms
- lastLogonTimestamp
- A replicated approximate last logon time (updated at most every 9–14 days), stored as FILETIME.
- FILETIME
- Windows time format: 100-ns intervals since 1 January 1601 UTC.
- PASSWD_NOTREQD (32)
- userAccountControl flag that lets the account have an empty password.
- DONT_EXPIRE_PASSWORD (65536)
- The password never expires, whatever the domain policy says.
- Joiner-mover-leaver
- The HR-driven process that creates, changes and disables accounts as people join, move and leave.
← The OWASP Top 10, and what attacks look like in a log · All lessons · Windows security events →