Emergency Access Account Password Change Alert [CHK-1052]
This check alerts when the password of an Emergency Access Account has been changed.
Rationale
The Emergency Access Account is intended for use only in emergencies. Monitoring its use and modifications, especially password changes, is crucial as these could indicate potential misuse.
Fix
An automated fix is not available for this issue.
Manual steps:
- If the check results in a Warning, verify the changes.
- If the change is suspected to be unauthorized, contact support for further steps.
Impact
The check has two possible outcomes:
- Okay: No changes since the last check.
- Warning: The password of the Emergency Access Account has been changed.
More Information
Under normal circumstances, Emergency Access Accounts should not be modified and should only be used in case of major issues. If the password of the Emergency Access Account has been changed, the following details will be provided for each account:
- Display Name
- User Principal Name
- Last password change
- Previous change