Restrict Service Accounts from Privileged Groups
Service accounts shouldn't join Domain or Enterprise Admins for security.
Plain language
Service accounts are special kinds of user accounts used by applications or services to interact with the system. It's critical to keep these accounts out of high-level admin groups because if they're hacked, attackers could gain the keys to your entire system, leading to major data breaches or disruptions.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2026
Control Stack last updated
18 June 2026
E8 maturity levels
N/A
Guideline
Guidelines for system hardeningSection
Server Application HardeningOfficial control statement
Service accounts are not members of the Domain Admins, Enterprise Admins or other highly privileged security groups.
Why it matters
Unrestricted service accounts in admin groups could lead to complete system compromise, causing data loss, service disruption, or financial damage.
Operational notes
Regularly check and adjust group memberships; service accounts often don't need admin access but may get it by mistake over time.
Implementation tips
- IT team should create a separate list of all service accounts in the organisation. This can be done by reviewing the user directory and identifying accounts assigned to applications or services, rather than humans.
- System administrator should ensure these accounts aren't part of any high-level groups like Domain Admins. This involves checking group memberships and removing any service accounts found in these sensitive groups.
- Managers should work with IT to label and document the purpose of each service account. They need to write down what each account does and which systems it interacts with to ensure they are accounted for and properly managed.
- IT security should set up regular reviews of service account access. Periodically, perhaps quarterly, they should verify that no service accounts have been unintentionally granted high-level access.
- HR and IT should collaborate on a policy for creating new service accounts. There should be clear criteria for why and when a new service account is needed, ensuring they aren't created with unnecessary access rights.
Audit / evidence tips
- Askthe list of all service accounts: Request documentation that lists all service accounts including their roles and usageLook atwhether each account is clearly documented with its purpose and associated applicationGooda comprehensive list that matches known systems and uses
- Askthe group membership report: Obtain a report showing current group memberships of service accountsLook atthe specific groups each service account is a member ofGoodNo service accounts are listed in Domain Admins, Enterprise Admins or similar groups
- Askreview logs or meeting records: Request evidence of periodic reviews of service account accessLook atrecords that show these reviews occur at regular intervalsGoodDocumented records with dates and actions taken if any service accounts were found with improper access
- Askabout service account creation procedures: Inquire about the policies in place for creating new service accountsLook atwhether there is a documented process ensuring new accounts are evaluated for necessity and least privilegeGoodA policy document explaining the criteria and procedures for creating service accounts
- Askto see monitoring reports or alerts: Request logs that capture any changes in service account group membershipsLook atany alerts or follow-up actions taken when such changes occurGoodAlerts trigger investigations, and any unsuitable changes are quickly reversed
Cross-framework mappings
How ISM-1940 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 5.18 | ISM-1940 requires that service accounts are not members of Domain Admins, Enterprise Admins, or other highly privileged AD security groups | |
| Annex A 8.2 | ISM-1940 requires that service accounts are not members of highly privileged Active Directory groups (e.g., Domain Admins/Enterprise Admins) | |
E8
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| E8-RA-ML2.2 | ISM-1940 requires service accounts to be excluded from highly privileged AD groups such as Domain Admins and Enterprise Admins | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System hardening
See all Guidelines for system hardening controls, or browse the full ASD ISM library.