User account

Inside an operating system an account is little more than a numeric identifier with metadata. On Unix-like systems the kernel knows only the UID and GIDs; /etc/passwd maps the user name to UID, primary GID, home directory and login shell, while the password hash moved to the root-readable /etc/shadow so it is no longer world-readable. Name resolution goes through NSS, so the same UID can come from local files, LDAP or SSSD, and UID 0 is root regardless of its name. Windows identifies accounts by security identifier (SID), stored in the local SAM database or in Active Directory; the built-in Administrator always has relative ID 500. Because ACLs store SIDs or UIDs rather than names, renaming an account keeps its rights, whereas deleting it and recreating one with the same name does not restore them, and a reused UID can silently inherit a former user's files.

Accounts come in distinct classes that need different controls: personal accounts, privileged or administrative accounts, service and machine accounts, guest or external accounts (for example B2B guests in a cloud directory), and emergency "break-glass" accounts. Shared or generic accounts are the problem case, because log entries can no longer be tied to one person, which defeats accountability.

Most account risk lives in the lifecycle. The joiner-mover-leaver process should be driven by an authoritative source, typically HR, with provisioning pushed to applications through SCIM (RFC 7643 and RFC 7644) or connectors. Movers are where privilege creep happens, because new rights are added and old ones are rarely removed. NIST SP 800-53 Rev. 5 control AC-2 (Account Management) sets out the requirements, and CIS Controls v8.1 makes them concrete: Safeguard 5.1 keeps an inventory of accounts, 5.3 disables accounts dormant for 45 days, and 5.4 restricts administrator privileges to dedicated administrator accounts. Disabling before deleting preserves the audit trail and ownership of data.

Attackers value accounts because a valid login blends in: MITRE ATT&CK lists Valid Accounts (T1078) for initial access and persistence, and Create Account (T1136) for planting new ones. Login pages that answer differently for unknown and known user names allow account enumeration, and hard lockout after a few failures turns into a denial-of-service lever, which is why NIST SP 800-63B prefers rate limiting, capped at 100 consecutive failed attempts per authenticator on an account. An account is not an identity: one identity may hold many accounts across systems, and an account whose identity has left the organisation is an orphaned account.