Best practices for inactive accounts

1. What's the danger of an inactive account?
2. Which of the following are best practices for disabling unused user accounts?
3. How quickly must inactive accounts be removed or disabled?
4. Do companies delete inactive accounts?

What's the danger of an inactive account?

Inactive accounts or accounts that have never logged in to a machine are also known as “stale” user accounts. Stale accounts pose a security risk to organizations. Each one of these accounts offers a malicious actor an opportunity to gain access to resources.

Which of the following are best practices for disabling unused user accounts?

Active Directory features are the best bet for manually disabling and deleting unused accounts but they are effective only when the AD environment is small.

How quickly must inactive accounts be removed or disabled?

The STIG stipulates that all accounts are to be disabled after 30 days of inactivity/no access.

Do companies delete inactive accounts?

No. It has no concept of an “inactive” account. An account will only be deleted if the owner does so explicitly. EDIT: this is no longer true.