Zombie accounts are quietly haunting Active Directory — and most audit tools can't find them
Hunting 'Zombie Accounts' in Active Directory
A hands-on account of hunting zombie accounts: identities that are active and usable but no longer have an authorized owner. The author explains why usage and integrity audits miss these validity problems, walks through common causes like protected accounts, forgotten test mistakes, and shadow IT from Adobe or Canva sign-ups, and shares PowerShell and SQL scripts for culling stale users and computers — including a cleanup that removed 9,000 zombie computer accounts.
Tools that audit usage or integrity don't necessarily audit validity, and zombie accounts are primarily validity issues.