---
title: Tip: find vendor-created test accounts and shared local-admin passwords before ransomware crews do: one AD query, Windows LAPS, and an account-ownership clause in every outsourcing contract | ctxsec
url: https://ctxsec.com/items/tip-kill-dormant-test-accounts-unique-local-admin
description: ""
status: "tip (lessons from the ICO Data Cymru / Ogi reprimands)"
published: 2026-10-20
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-kill-dormant-test-accounts-unique-local-admin.md)

tip (lessons from the ICO Data Cymru / Ogi reprimands)

2026-10-20

### Tip: find vendor-created test accounts and shared local-admin passwords before ransomware crews do: one AD query, Windows LAPS, and an account-ownership clause in every outsourcing contract

The [Data Cymru breach](/industry#ico-reprimands-ogi-data-cymru-password1) needed only two things: a forgotten `Test2` account with `Password1`, and the same local admin password on every server. Both are cheap to find.

1. **Stale and test accounts:** in AD, list enabled accounts that haven't logged on in 90+ days or whose names match test/temp/demo/vendor/svc patterns. For example: `Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly | ?{$_.Enabled}`, plus `Get-ADUser -Filter 'Name -like "*test*"' -Properties PasswordLastSet,LastLogonDate`. Flag any with `PasswordLastSet` years ago or `PasswordNeverExpires`. Disable first, delete after an owner confirms.
2. **Weak passwords:** audit AD hashes offline against a breached and common-password list (for example with a tool like DSInternals' `Test-PasswordQuality`, run by your security team with approval). `Password1` meets old complexity rules, so complexity alone doesn't stop it.
3. **Unique local admin passwords:** deploy **Windows LAPS** (built into supported Windows) so each machine's local admin password is random and rotated. That breaks the move from one host to the next with a reused hash. Also deny network logon for local accounts via GPO.
4. **Outsourced IT:** write into contracts who creates, reviews and removes accounts in your directory, with a quarterly attested list of vendor-created accounts. The ICO faulted both the customer and the provider for leaving that gap.
5. **Remote access:** require MFA for every remote path (VPN, RDP gateway, admin portals), including service and vendor accounts.

Sources: [ICO news release (Oct 20)](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/password1-is-not-an-appropriate-password/) · [Microsoft Learn: Windows LAPS overview](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview) · [Microsoft Learn: Search-ADAccount](https://learn.microsoft.com/en-us/powershell/module/activedirectory/search-adaccount)