October is Cybersecurity Awareness Month, and CISA's theme this year is "Securing the Next 250." Most of the campaign material is aimed at everyone: spot phishing and turn on multi-factor authentication. Security teams can close a gap of their own this month: the admin accounts nobody uses anymore.
Most companies have them: a contractor's login from a project that ended last spring, or a service account for a system switched off two years ago. Each one still works, and nobody would notice if someone else logged in with it.
A dormant admin account is a password nobody is watching. Stolen credentials led Verizon's Data Breach Investigations Report as the most common way in until this year, when exploited vulnerabilities overtook them for the first time.
Some accounts are meant to sleep
Before anything gets disabled, list the accounts that look dormant on purpose. Break-glass admin accounts sit unused until an emergency. Year-end batch jobs run once a year. Disabling either causes an outage at the worst moment, so mark each one with an owner and a reason, and keep them out of everything that follows.
Quarterly reviews let the rest through
Most companies review privileged access quarterly or yearly. Someone exports the accounts with admin rights from each system and asks managers to confirm them. Managers tend to approve what they don't recognise, because rejecting it might break something, so the review gets signed off with the dormant accounts still in it.
HR knows who left or moved, and each system logs last sign-ins, but nobody joins the two because it means pulling data from a dozen places by hand.
Join HR records to sign-in logs
That join is the agent's job. Connect it, read-only, to the identity provider, the HR system and the sign-in logs of your most sensitive systems. For every account with elevated privileges, it asks:
- Is it tied to a current employee or an active contract?
- Has that person's role changed since the access was granted?
- When did the account last sign in, and when did it last use its privileges?
- For service accounts, does the system it serves still exist, and does it have a named owner?
Anything that fails goes into a queue with its evidence, for example: "Contractor, contract ended four months ago, no sign-in since, still holds admin on a production database."
A person approves each disable to begin with. Over a few weeks, the approvals show which findings never get overruled, like accounts belonging to people HR shows as gone for more than 30 days. Those can be disabled automatically with a notice to the owner, and the ambiguous ones keep a person on them.
Daily instead of quarterly
A quarterly review can leave a leaver's access live for up to three months. Running the comparison daily closes that to a day, and the weekly review of the queue stays short because each entry arrives with its evidence.
Start this month with the system where a forgotten admin account would do the most damage.
Frequently asked questions
What is a dormant privileged account?
An account with administrative or other elevated access that hasn't been used for a set period, often 90 days. It might belong to someone who left, a contractor whose work ended, or a service that was retired.
Why are dormant admin accounts a risk?
Nobody watches them, so a stolen password for one can be used without anyone noticing. Stolen credentials were the most common way in recorded by Verizon's Data Breach Investigations Report until 2026, when exploited vulnerabilities overtook them for the first time.
Can an agent disable accounts automatically?
Eventually, for the clear-cut cases. At first a person should approve each change. Some accounts look dormant and are used once a year, such as break-glass admin accounts or year-end batch jobs, and disabling those causes outages.
How often should dormant accounts be reviewed?
Daily if an agent is doing the comparison, with a person reviewing its queue weekly. A quarterly manual review can leave a leaver's access live for up to three months.