Orphaned accounts are identities that continue to function but lack a current owner This article explores orphaned accounts identities. . This guide elucidates why these remnants are a prime entry point for intruders, outlines methods to locate them across directories, SaaS, and cloud platforms, provides safe ways to eliminate them, and suggests a process to prevent new ones from accumulating.
Developer platforms: personal access tokens, deploy keys, and CI secrets created by departing employees.
# Illustrative: enabled AD users inactive for 45+ days ```powershell Import-Module ActiveDirectory Search-ADAccount -AccountInactive -TimeSpan 45.00:00:00 -UsersOnly | Where-Object { $_.Enabled } | Get-ADUser -Properties lastLogonTimestamp, manager, department, whenCreated, description | Select-Object SamAccountName, Department, Manager, whenCreated, @{n=’LastLogon’;e={[DateTime]::FromFileTime($_.lastLogonTimestamp)}}, Description | Export-Csv .\inactive-users.csv -NoTypeInformation ``` Similarly, the same logic can be applied to other identity stores such as Entra ID, Okta, or cloud IAM credential reports, and SaaS admin exports.
// Illustrative: successful sign-ins after 45+ days of inactivity SigninLogs | where TimeGenerated > ago(90d) and ResultType == “0” | project UserPrincipalName, TimeGenerated, IPAddress, AppDisplayName, Location | sort by UserPrincipalName asc, TimeGenerated asc | extend PrevUser = prev(UserPrincipalName), PrevSignIn = prev(TimeGenerated) | where UserPrincipalName == PrevUser and TimeGenerated – PrevSignIn > 45d | extend DaysDormant = datetime_diff(‘day’, TimeGenerated, PrevSignIn) | project UserPrincipalName, TimeGenerated, DaysDormant, IPAddress, AppDisplayName, Location Pair it with related detections: Sign-ins by terminated HR accounts (requires an HR feed into your SIEM watchlist).
