An audit finds batch-job service accounts for the water billing sys…

Question

An audit finds batch-job service accounts for the water billing system with non-expiring passwords and interactive logon rights on jump hosts. Which remediation best hardens those accounts?

Accepted Answer

Prohibit interactive logon, manage secrets in a vault with rotation, and restrict each account to least-privilege service use — Service accounts are not people and should not lounge on jump boxes. Lock interactive logon, stash secrets in a vault with rotation, and keep rights skinny—non-expiring password plus Domain Admin is how outages become breaches.

Answer

Give every service account a mailbox so password resets arrive by email

Answer

Convert service accounts into personal user accounts for the night operators

Answer

Set passwords to never expire and add the accounts to Domain Admins for reliability

An audit finds batch-job service accounts for the water billing system with non-expiring passwords and interactive logon rights on jump hosts. Which remediation best hardens those accounts?

Short Explanation

Full Explanation