ASD ISM 1932 Limit service accounts with SPNs in Active Directory
What it says
The number of service accounts configured with an SPN is minimised.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReduce the number of special accounts to improve security in Active Directory.
This control is about reducing the number of special accounts, called service accounts, that have something called a Service Principal Name in Active Directory. By keeping the number of these accounts to a minimum, it helps prevent unauthorised access to important systems. If this isn't done, hackers could exploit these special accounts to access sensitive data and control your systems, which could lead to data breaches and operational disruption.
Free. Save your status, tasks and notes.
Why it matters
Too many AD service accounts with SPNs increase Kerberoasting and credential theft risk, enabling lateral movement and broader domain compromise.
How to implement
IT team should identify all existing service accounts in Active Directory.
They can do this by running a query in the system to list all accounts that currently have a Service Principal Name associated with them.
System administrators should review the necessity of each service account.
This involves checking if each account is actively used and essential for business operations. Unused or unnecessary accounts should be disabled or deleted.
IT security officers should confirm that remaining service accounts meet security requirements.
This means ensuring these accounts have strong, unique passwords and follow company security protocols. Consider implementing password policies that require regular updates.
Managers should collaborate with IT to ensure that new service accounts are created only when essential.
They review requests for new accounts to ensure they are justifiable and tied to specific business needs.
The IT team should regularly audit service accounts.
This involves setting up a schedule, perhaps quarterly, to check if all existing service accounts with Service Principal Names are still required and verifying compliance with security standards.
Keep it running
Periodically inventory accounts with SPNs, remove unused SPNs, consolidate where possible, and retire unneeded service accounts to minimise attack surface.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of all service accounts with Service Principal Names: Request the latest export or report that shows all such accounts in Active Directory.
Look at
The number of accounts and how frequently the list is reviewed.
Good evidence
Is a recent document showing a reduced number of service accounts compared to past records.
- Check 2 of 5What an auditor asks for
Ask for
Documentation on the review process of service accounts.
Look at
Descriptions of the review process and criteria used for determining necessity.
Good evidence
Is a document that outlines a clear procedure with steps followed and roles responsible.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of service account deletion or disablement: Request records of actions taken based on the review process.
Look at
The dates and justifications for these actions.
Good evidence
Includes logs or change requests showing accounts were removed or disabled and reasons for these actions.
- Check 4 of 5What an auditor asks for
Ask for
Security policy documents related to service accounts.
Look at
Mentions of password policies and security measures specific to these accounts.
Good evidence
Includes detailed policies on password complexity and update frequency specific to service accounts.
- Check 5 of 5What an auditor asks for
Ask for
Records of recent audits of service accounts: Request audit logs or summaries from the past year.
Look at
Identified issues and actions taken to resolve them.
Good evidence
Shows proactive management with documented findings and follow-up actions to reduce account numbers.
Mappings
Closest match in ISO/IEC 27001: A.8.2, Management of privileged access rights, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.2.
Annex A 8.2 requires privileged access rights to be restricted and managed to reduce the risk of misuse or compromise. ISM-1932 relates by requiring minimisation of service accounts configured with SPNs in Active Directory, which directly constrains a common form of privileged or high-impact authentication configuration. ISM-1932 is narrower and technology-specific (AD SPNs/service accounts), while Annex A 8.2 applies to privileged access rights more generally across systems and platforms.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.