Boo! Beware the ghost admin!

If you thought your regular sysadmin scared you after you spilled coffee on your laptop twice in one week, there’s a far spookier IT figure lurking in the forgotten corners of the infrastructure: the ghost admin.

A ghost admin, according to Craig Birch, principal technologist at identity-management software company Cayosoft, refers to a non-human entity capable of administrative impact (think: controlling access or managing data) without any kind of administrative governance.

Left unnoticed, this invisible, often highly privileged account can be hijacked and brought back to life, zombie style, ready to eat the heart of your IT infrastructure.

Here’s what to do if there’s something strange in your Active Directory and it…don’t look good.

They’re here. Privileged admin accounts, which are capable of high-impact actions like access control and data management, can end up forgotten on IT’s radar.

A service account, or non-human identity, may perform important functions to relieve a human of certain responsibilities, like a late-night backup or report generation. If this highly privileged account has lived on without an owner, its access keys may be available via public repos, support tickets, or collaboration tools—and may not set off any alarms when activated, given that someone at the company likely created the pathway legitimately.

Erich Kron, CISO advisor at cybersecurity company KnowBe4, has seen ghost admin accounts left active after migrations from on-premise systems to services like cloud-based email or Active Directory.

“One of the things that can happen sometimes is accounts that were not even meant to be a privileged account end up a privileged account because that gets things working very quickly,” Kron told us.

Kron recommends auditing all service accounts and checking the last usage of any suspected account. Consider disabling it—or setting a very strong password—then waiting a few months to catch any dependencies before deleting it, he said. (Google allows you to identify service accounts that have not been used in the past 90 days; Microsoft also has auto-discovery features for service accounts.)

Getting ghosted. Forgotten, highly privileged accounts may lack ownership and strong access controls like multi-factor authentication (MFA). And that means a threat actor can hop into systems and haunt your screens.

Verizon’s 2026 Data Breach Investigations report revealed that just over a third (37%) of its surveyed organizations had an admin account with multifactor authentication (MFA) disabled on an infrastructure-as-a-service (IaaS) offering.

In a September 22 post, email security and data protection company Proofpoint revealed how threat actors targeted Chilean organizations and successfully compromised seven unmanaged service accounts “with no prior legitimate login baseline, strongly indicating default or predictable passwords that had never been rotated, with no MFA enforcement.”

Birch recommends that service accounts have an assigned owner—and a new assigned owner once that person departs. In addition, that owner must regularly attest that the service account is still necessary for some part of the organization to function. Birch also advised IT pros to assign specific identities to applications and servers, and place them in a database so they’re reviewed or removed during tech refreshes and app and server shutdowns.

“If you put the same governance in place that you would on a human, then you wouldn’t have this problem. You wouldn’t have ghost admins because they’d be governed,” Birch said.