Dormant service account disablement system
Various aspects of the disclosure relate to identifying and disabling dormant service accounts. An account management system automatically analyzes service account activity records to determine whether each service account defined for an enterprise network is in use. Automated monitoring applications may be used for identifying and authenticating events and/or authentications of service accounts across an enterprise network. When particular service accounts are identified as being potentially dormant, based on an identified date of last use meeting a threshold condition, the associated service accounts are flagged as being dormant. Setting an account as being dormant triggers solicitation of feedback confirming the dormant setting, which causes disablement of the service account. The account management system triggers decommissioning of the dormant service accounts upon expiration of a disablement threshold.
1. A method comprising:
aggregating, automatically by service account monitoring engine, event activities of a plurality of service accounts on an enterprise network, wherein each service account comprises a machine user account in a user management system that enables autonomous operation of an autonomous job within the enterprise network and wherein operation of the autonomous job fails without a valid service account;
determining, based on aggregated information associated with the event activities of the plurality of service accounts, an identity of a plurality of potentially dormant service accounts;
verifying, automatically in response to generation of a listing of the plurality of potentially dormant service accounts, whether each potentially dormant service account is dormant or active;
disabling, automatically based on a received confirmation input confirming dormancy of a first potentially dormant service account, monitoring of the first potentially dormant service account;
disabling the first potentially dormant service account;
re-enabling, based on failure of an autonomous job whose operation is reliant upon the first potentially dormant service account, the first potentially dormant service account; and
decommissioning, at a directory service server and automatically based on expiration of a disablement time threshold, the first potentially dormant service account.
2. The method of claim 1 wherein aggregating event activities of the plurality of service accounts comprises:
retrieving, via the enterprise network, event logs associated with service account activities associated with each application of a plurality of applications associated with the plurality of service accounts; and
retrieving, via the enterprise network and from a directory service, service account event and activity records associated with each application of the plurality of applications.
3. The method of claim 2 , wherein the plurality of service accounts comprises a subset of the plurality of service accounts and wherein the subset of service accounts comprises a listing of service accounts having an active status.
4. The method of claim 1 , further comprising generating a historical data store of service account activities, the historical data store comprising event and activity information associated with each service account managed by a directory service.
5. The method of claim 4 , wherein determining an identity of a plurality of potentially dormant service accounts comprises identifying, from historical aggregated event data, service accounts having no logged activity within a first defined time period.
6. The method of claim 5 , wherein the first defined time period comprises 180 days.
7. The method of claim 1 , further comprising:
initiating, based on a re-enablement request, a re-enablement process to restore operation of a restored service account that had been previously disabled; and
re-enabling monitoring of a restored service account based on receiving a re-enablement request input.
8. The method of claim 1 , wherein a disablement event comprises setting an enablement flag within a directory service that is associated with a confirmed dormant service account and an enablement event comprises resetting the enablement flag.
9. A system comprising:
a directory service managing a plurality of service accounts, each service account corresponding to an automated job within an enterprise network, wherein the automated job is inoperable without an associated and enabled service account; and
a computing device comprising:
a processor; and
non-transitory memory storing instructions that, when executed by the processor, cause the computing device to:
aggregate, automatically by a service account monitoring engine, event activities of a plurality of service accounts on an enterprise network, wherein each service account comprises a machine user account in a user management system that enables autonomous operation of a computerized process within the enterprise network;
determine, based on aggregated information associated with the event activities of the plurality of service accounts, an identity of a plurality of potentially dormant service accounts;
verify, automatically in response to generation of a listing of the plurality of potentially dormant service accounts, whether each potentially dormant service account is dormant or active;
disable, automatically based on a received confirmation input confirming dormancy of a first potentially dormant service account, monitoring of the first potentially dormant service account;
re-enable, based on failure of an autonomous job whose operation is reliant upon the first dormant service account, the first potentially dormant service account; and
decommission, automatically based on expiration of a disablement time threshold, the first potentially dormant service account.
10. The system of claim 9 , wherein the instructions further cause the computing device to
retrieve, via the enterprise network, event logs associated with service account activities associated with each application of a plurality of applications associated with the plurality of service accounts; and
retrieve, via the enterprise network and from a directory service, service account event and activity records associated with each application of the plurality of applications.
11. The system of claim 10 , wherein the plurality of service accounts comprises a subset of the plurality of service accounts and wherein the subset of service accounts comprises a listing of service accounts having an active status.
12. The system of claim 9 , wherein the instructions further cause the computing device to generate a historical data store of service account activities, the historical data store comprising event and activity information associated with each service account managed by the directory service.
13. The system of claim 12 , wherein the instructions further cause the computing device to identify, from historical aggregated event data, service accounts having no logged activity within a first defined time period.
14. The system of claim 13 , wherein the first defined time period comprises 180 days.
15. The system of claim 9 , wherein the instructions further cause the computing device to:
initiate, based on a re-enablement request, a re-enablement process to restore operation of a restored service account that had been previously disabled; and
re-enable monitoring of a restored service account based on receiving a re-enablement request input.
16. The system of claim 9 , wherein a disablement event comprises setting an enablement flag within the directory service that is associated with a confirmed dormant service account and an enablement event comprises resetting the enablement flag.
17. A non-transitory computer readable medium storing instructions that, when executed by a processor, cause a computing platform to:
aggregate, automatically by service account monitoring engine, event activities of a plurality of service accounts on an enterprise network, wherein each service account comprises a machine user account in a user management system that enables autonomous operation of an autonomous job within the enterprise network and wherein operation of the autonomous job fails without a valid service account;
determine, based on aggregated information associated with the event activities of the plurality of service accounts, an identity of a plurality of potentially dormant service accounts;
verify, automatically in response to generation of a listing of the plurality of potentially dormant service accounts, whether each potentially dormant service account is dormant or active;
disable, automatically based on a received confirmation input confirming dormancy of a first potentially dormant service account, monitoring of a first dormant service account;
re-enable, based on failure of an autonomous job whose operation is reliant upon the first dormant service account, the first dormant service account; and
decommission, automatically based on expiration of a disablement time threshold, the first dormant service account.
18. The non-transitory computer readable medium of claim 17 , wherein the instructions further cause the computing platform to
retrieve, via the enterprise network, event logs associated with service account activities associated with each application of a plurality of applications associated with the plurality of service accounts; and
retrieve, via the enterprise network and from a directory service, service account event and activity records associated with each application of the plurality of applications.
19. The non-transitory computer readable medium of claim 17 , wherein the instructions further cause the computing platform to generate a historical data store of service account activities, the historical data store comprising event and activity information associated with each service account managed by a directory service.
20. The non-transitory computer readable medium of claim 17 , wherein the instructions further cause the computing platform to:
initiate, based on a re-enablement request, a re-enablement process to restore operation of a restored service account that had been previously disabled; and
re-enable monitoring of a restored service account based on receiving a re-enablement request input.