User Account Management

Bottom Line: The biggest security threat to your business isn't sophisticated hackers—it's poor user account management. Excessive permissions, orphaned accounts, and weak access controls are involved in the majority of security incidents. This guide covers what to do about it.

---

What You'll Learn

• Implement least privilege access to minimize security risk
• Manage the complete account lifecycle from hire to departure
• Configure Active Directory accounts, groups, and policies correctly
• Set up effective password policies and multi-factor authentication
• Establish audit procedures and compliance reporting

---

1. Core Security Principles

1.1 Least Privilege Access

Principle: Every user should have the minimum permissions needed to do their job—nothing more.

Role	Appropriate Access	Inappropriate Access
Accounting Staff	QuickBooks, financial folders	Engineering files, admin rights
HR Personnel	Employee database, HR systems	Server administration, all-department access
Sales Team	CRM, sales folders, customer data	Source code, financial records
IT Administrators	System administration tools	Production data (unless required)

Why It Matters: When someone clicks a malicious email attachment, the malware inherits their access level. An admin account breach = full network compromise. A limited account breach = limited damage.

---

1.2 Account Lifecycle Management

Every user account follows a predictable lifecycle. Each stage requires specific actions:

Stage	Actions Required	Timeline
Creation	Create account, assign role-based groups, document	Day 1 of employment
Active Use	Monitor activity, review access quarterly	Ongoing
Modification	Update groups when role changes, document reason	Within 24 hours of role change
Temporary Access	Set expiration date, document approval	As needed (auto-expire)
Deactivation	Disable immediately, preserve data if needed	Same day as departure
Deletion	Remove account after retention period	30-90 days post-departure

Warning: A Modesto company we worked with had an ex-employee access their systems for three weeks after termination. The damage was expensive. Same-day deactivation is non-negotiable.

---

2. Active Directory Configuration

2.1 Account Creation Standards

Consistency in account creation prevents confusion and security gaps.

Naming Convention Options

Convention	Example	Best For
First Initial + Last Name	jsmith	Small organizations (< 100 users)
First.Last	john.smith	Medium organizations
Full First + Last Initial	johns	Legacy systems
Email-based	john.smith@company.com	Cloud-first organizations

Important: Choose one convention and use it everywhere. Inconsistency creates confusion and security blind spots.

---

2.2 Organizational Unit (OU) Structure

Organize accounts by department or function to simplify Group Policy application:

Company.local
├── Users
│   ├── Executive
│   ├── Finance
│   ├── Sales
│   ├── Engineering
│   ├── HR
│   └── IT
├── Computers
│   ├── Workstations
│   └── Servers
└── Service Accounts

---

2.3 Security Group Strategy

Use groups for permission assignment instead of individual user permissions.

Recommended Group Naming Convention

Group Name	Purpose	Members
Accounting-ReadOnly	Read access to accounting files	Accounting staff
Accounting-FullAccess	Full access to accounting files	Accounting managers
Engineering-FullAccess	Full access to engineering resources	Engineering team
HR-Confidential	Access to sensitive HR data	HR personnel only
Sales-CRM	CRM application access	Sales team
IT-Admins	Administrative access	IT staff

Best Practice: When Bob moves from Sales to Marketing, simply remove him from Sales groups and add him to Marketing groups. No individual permission changes needed.

Warning: Avoid nesting groups inside groups inside groups. Troubleshooting "why doesn't Bob have access?" becomes a nightmare with multiple layers of inheritance.

---

3. Password and Authentication Policies

3.1 Password Policy Requirements

Setting	Minimum Recommendation	Optimal	Why
Minimum Length	12 characters	14+ characters	Longer passwords resist brute force
Complexity	Upper, lower, number, special	Same	Increases keyspace exponentially
Expiration	90 days	180 days + MFA	Too frequent = sticky notes
History	Remember 12	Remember 24	Prevents password rotation patterns
Lockout Threshold	5-10 attempts	5 attempts	Slows automated attacks
Lockout Duration	30 minutes	30 minutes or admin unlock	Balance security and productivity

---

3.2 Multi-Factor Authentication (MFA)

MFA is non-negotiable for critical applications.

Application Type	MFA Required?	Priority
Email (Office 365, Google)	Yes	Critical
VPN and Remote Access	Yes	Critical
Financial Systems	Yes	Critical
Customer Databases/CRM	Yes	High
Internal File Shares	Recommended	Medium
General Applications	Recommended	Medium

Success Story: A Stockton business prevented a major breach because the attacker had the password but not the MFA token. MFA was the difference between a near-miss and a catastrophe.

---

4. Permission Management

4.1 NTFS vs. Share Permissions

Permission Type	Applies To	Recommendation
Share Permissions	Network access only	Set to "Everyone - Full Control"
NTFS Permissions	Local and network access	Control actual access here

Rule: When both permissions apply, the more restrictive wins. Control access with NTFS permissions; use shares simply for network accessibility.

---

4.2 Permission Inheritance

Setting	When to Use	Caution
Enable Inheritance	Standard folders following parent structure	Default behavior
Block Inheritance	Sensitive folders requiring different access	Can create management complexity
Explicit Permissions	Override inherited permissions	Document thoroughly

---

5. Audit and Compliance

5.1 Audit Schedule

Audit Type	Frequency	Purpose
Group membership review	Quarterly	Verify users are in correct groups
Permission audit	Quarterly	Identify excessive or orphaned permissions
Privileged account review	Monthly	Ensure admin accounts are necessary and active
Inactive account scan	Monthly	Identify accounts for deactivation
Compliance report	Annually	Document regulatory compliance

---

5.2 Compliance Mapping

Regulation	User Management Requirements
HIPAA	Access controls, audit logs, minimum necessary access
SOX	Segregation of duties, access reviews, change documentation
PCI-DSS	Unique user IDs, password requirements, access logging
CMMC	Identity management, least privilege, account management

---

5.3 What to Log

Event Type	Retention	Alert On
Account creation	1 year	All events
Account deletion/disable	1 year	All events
Permission changes	1 year	Admin groups, sensitive folders
Password resets	90 days	Admin accounts
Failed logins	90 days	> 5 failures in 10 minutes
Admin actions	1 year	All events

---

6. Automation and Efficiency

6.1 Automation Opportunities

Task	Manual Time	Automated Time	Tool Options
New user creation	30-60 minutes	2-5 minutes	PowerShell, automated provisioning
Termination processing	15-30 minutes	Immediate	HR integration, workflow automation
Password reset	5-10 minutes	Self-service	Self-service portal with MFA
Permission reports	2-4 hours	Minutes	Automated reporting tools

---

6.2 Recommended Third-Party Tools

Category	Purpose	Examples
Identity Management	Centralized user lifecycle management	Microsoft Entra ID, Okta, JumpCloud
Privileged Access Management	Secure admin account access	CyberArk, BeyondTrust, Delinea
Automated Provisioning	HR-integrated account management	SailPoint, Saviynt
Compliance Monitoring	Continuous compliance verification	Netwrix, Varonis

---

7. Security Checklist

Use this checklist for ongoing user account security:

• All accounts follow standardized naming convention
• Users assigned to appropriate groups (not individual permissions)
• Least privilege access implemented for all roles
• Password policy meets minimum requirements
• MFA enabled for all critical applications
• Terminated employee accounts disabled same-day
• Quarterly access reviews scheduled and completed
• Privileged accounts audited monthly
• All permission changes documented
• Compliance reports generated annually

---

Key Takeaways

Principle	Action
Least Privilege	Give users only what they need
Lifecycle Management	Track accounts from creation to deletion
Group-Based Access	Assign permissions to groups, not individuals
Regular Audits	Review quarterly; don't wait for incidents
Document Everything	Record changes, approvals, and justifications

---

Need Help?

Most security breaches involve compromised credentials or excessive permissions. Fixing user account management addresses a huge portion of your security risk. We've done this for dozens of Central Valley businesses—sometimes you just need an experienced pair of eyes and proven procedures.