CIS-5.3 Disable Dormant Accounts

• T1078 Valid Accounts — Disabling stale accounts removes valid authentication paths available to adversaries. • T1078.001 Default Accounts — Disabling stale accounts removes valid authentication paths available to adversaries. • T1078.002 Domain Accounts — Dormant domain accounts can retain broad access; disabling them removes stale domain credentials from the attack surface. • T1078.003 Local Accounts — Disabling inactive local accounts reduces stale local credential abuse, dependent on endpoint/server coverage. • T1078.004 Cloud Accounts — Disabling inactive cloud/SaaS accounts removes abandoned identities usable for access, persistence, or privilege abuse. • T1110.004 Credential Stuffing — Disabling dormant accounts removes stale accounts that may still have breached or reused credentials, reducing credential-stuffing success against abandoned identities.