ASD ISM 0380 Disable unneeded OS accounts and services
What it says
Unneeded user accounts, components, services and functionality of operating systems are disabled or removed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRemove or turn off unnecessary user accounts and services on operating systems to improve security.
This control is about shutting down or removing user accounts and services on computer systems that aren't needed. Doing this helps protect your business from hackers who might use these unused accounts or services to break into your systems and cause trouble, like stealing information or disrupting your operations.
Free. Save your status, tasks and notes.
Why it matters
Leaving unused OS accounts or services enabled creates unnecessary entry points, increasing the likelihood of privilege misuse, compromise and outages.
How to implement
System owners should review all user accounts on their systems: Go through your system's user list carefully and flag any accounts that are no longer in use, such as accounts of former employees.
Ensure these accounts are removed or deactivated promptly.
IT teams should assess all services running on operating systems: Check what services your system is currently using and identify any that are redundant.
For those not needed, disable them to ensure they cannot be exploited.
Managers should coordinate with HR to update IT departments about staff changes: Work together to ensure that when someone leaves the organisation, their access is revoked immediately.
Create a quick checklist for HR to notify IT of staff departures as part of the exit process.
IT security staff should periodically audit system configurations: Schedule regular checks of system accounts and active services every few months.
Use a simple log or checklist to track which accounts and services have been deactivated since the last check.
System administrators should enable service logging: For system services that are essential, ensure logging is enabled to quickly detect and respond to any suspicious activity.
Regularly review these logs to spot and resolve potential issues early.
Keep it running
Regularly review OS accounts and running services; disable or remove default, unused or legacy items, and verify only required services start at boot to minimise attack surface.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of current user accounts: Request a report or spreadsheet detailing all user accounts active in the system.
Look at
The list to identify any accounts that should no longer be active, like former employees.
Good evidence
Shows only current staff and necessary service accounts.
- Check 2 of 5What an auditor asks for
Look at
Entries showing the deactivation of accounts, along with dates and who authorised the removal.
Good evidence
Includes recent entries and clear authorisation details.
- Check 3 of 5What an auditor asks for
Ask for
A report of active system services: Check the list of services running on the system.
Look at
Unexpected or non-essential services that might still be enabled.
Good evidence
Only lists services essential for operations and nothing extraneous.
- Check 4 of 5What an auditor asks for
Ask for
How regularly they review and remove unnecessary accounts.
Good evidence
Includes a specific frequency for reviews and clarity on who performs the checks and how access is terminated.
- Check 5 of 5What an auditor asks for
Good evidence
Shows documented actions taken following the review.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML1.1, Disable or remove Internet Explorer 11, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.9.
ISM-0380 requires unneeded operating system user accounts, components, services and functionality to be disabled or removed to reduce attack surface. Annex A 8.9 requires configurations (including security configurations) across hardware, software, services and networks to be established, documented, implemented, monitored and reviewed, which includes disabling/removing unnecessary OS accounts and services as a baseline hardening activity. The ISO control is broader because it covers the full configuration management lifecycle and many configuration domains beyond OS accounts/services, whereas ISM-0380 is a specific hardening outcome focused on removing unneeded OS functionality.
This control partially overlaps A.5.16.
Annex A 5.16 requires managing identities across creation, change, review and deactivation, including ensuring accounts are retired when no longer required (leavers and role changes). ISM-0380 overlaps by explicitly requiring unneeded user accounts to be disabled or removed, which is a direct lifecycle offboarding outcome and also applies during movers when accounts/functions become unnecessary. However, ISM-0380 also extends beyond identities into hardening (components/services/functionality), while Annex A 5.16 covers broader identity lifecycle governance beyond disabling/removal alone.
ASD Essential Eight: 3 mappings
This control is broader than E8-AH-ML1.1.
E8-AH-ML1.1 requires Internet Explorer 11 to be disabled or removed to reduce exposure to a legacy, vulnerable browser. This relates directly to ISM-0380 because removing or disabling unneeded operating system components and functionality is the broader hardening practice under which IE11 removal typically sits. ISM-0380 applies across many OS accounts, services and features, whereas E8-AH-ML1.1 is a single, specific software/component removal requirement.
This control is broader than E8-AH-ML3.2.
E8-AH-ML3.2 requires organisations to disable or remove Windows PowerShell 2.0 as a specific hardening action. ISM-0380 requires unneeded user accounts, components, services and functionality of operating systems to be disabled or removed, which would include removing legacy OS components such as PowerShell 2.0 where not required. ISM-0380 is broader OS hardening, while E8-AH-ML3.2 is a single targeted implementation within that broader requirement.
This control is broader than E8-AH-ML3.3.
E8-AH-ML3.3 requires PowerShell to be configured to use Constrained Language Mode, restricting available functionality to reduce attack techniques that rely on PowerShell. This relates to ISM-0380 because constraining PowerShell is a form of reducing unnecessary operating system functionality and services available to users and processes. ISM-0380 is broader and covers disabling or removing a wide range of unneeded OS accounts, components and services, whereas E8-AH-ML3.3 targets one specific scripting control.
ASD Essentials for enterprise IT: 4 mappings
- IT.PRO-01.1Design systems with telemetry, least privilege, data protection and minimal attack surfacePartially overlaps
This control partially overlaps IT.PRO-01.1.
IT.PRO-01.1 requires secure system design that minimises privileges, limits exposed services and removes unnecessary functionality; ISM-0380 applies this to operating systems, requiring unneeded user accounts, components, services and functionality to be disabled or removed.
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines, informed by hardening guidance, that disable unnecessary services, insecure settings and weak protocols; ISM-0380 requires unneeded operating system accounts, components, services and functionality to be disabled or removed, an overlap that does not require a baseline.
This control partially overlaps IT.PRO-13.1.
IT.PRO-13.1 requires regularly disabling or removing default and unused accounts, with only documented, justified, hardened and monitored exceptions; ISM-0380 overlaps on accounts, disabling or removing unneeded operating system user accounts, components, services and functionality.
- IT.PRO-13.5Disable legacy authentication protocols and restrict, monitor and decommission exceptionsPartially overlaps
This control partially overlaps IT.PRO-13.5.
IT.PRO-13.5 requires legacy authentication protocols to be disabled or, if not feasible, restricted, monitored and scheduled for decommissioning; ISM-0380 requires unneeded operating system accounts, components, services and functionality to be disabled or removed, a broader rule sharing that step.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.