Ask most IT teams how many domain admin accounts exist in their environment and the honest answer is often somewhere between an estimate and a shrug. Admin rights get granted to solve an urgent problem, to a departing employee’s replacement before the handover is properly documented, or to a service account during setup that never gets scoped back down. Each grant is individually reasonable. The accumulated total rarely is, and almost nobody has actually added it up.
Every admin account is a bigger target than a standard one
A standard user account, if compromised, typically gives an attacker access to that one person’s files, mailbox and whatever systems their role specifically requires. A domain admin account, if compromised, can give an attacker control over the entire domain: every user, every server, every piece of data the organisation holds. The more admin accounts exist, the more of these high-value targets an attacker has to aim at, and the greater the Chance that at least one of them is protected by a weak password, an outdated patch level, or a user who reuses credentials across other services entirely outside the organisation’s control.
Assessing this exposure properly is a core part of internal network pen testing, which maps the actual number of privileged accounts against genuine business need and tests how easily a standard compromised account could be escalated into one of them through misconfigured permissions or poor credential hygiene.
Sprawl happens through neglect, not decision
Nobody sits down and deliberately decides to create twenty-five domain admin accounts. It happens through years of incremental grants, each one sensible at the time and none of them ever revoked once the original need passed. IT staff who left the company two years ago but whose admin rights were never formally removed. Service accounts created for a migration project that finished long ago, still running with full privileges because nobody wants to risk breaking something by touching them, so the account simply stays as it is.
William Fieldhouse sees this pattern in a large proportion of the internal assessments Aardwolf carries out.
“We counted the domain admin accounts on one assessment and reached twenty-three in an organisation with about four hundred staff. Nine of those accounts belonged to people who no longer worked there. Two were service accounts nobody could identify the current owner of. That is not a technical vulnerability in the traditional sense. It is an open door that has simply never been closed.”
— William Fieldhouse, Director of Aardwolf Security Ltd
Nine former employees retaining domain admin rights is precisely the kind of finding that a technical vulnerability scan alone would never surface, because nothing about those accounts is technically broken. They authenticate correctly, they have valid credentials on paper, and they simply should not exist any more. Only a review that cross-references access against current employment and genuine business need catches this, which is exactly why it gets missed so often.
Cut the list down to who genuinely needs it
Audit every privileged account against a specific, current business justification, and remove access the moment a role or engagement ends rather than waiting for a scheduled review to catch it eventually. Combine that internal audit with penetration testing quote to test how well your remaining privileged accounts are actually protected. Contact Aardwolf Security to find out exactly how many keys to the kingdom your organisation is currently handing out.
