Active Directory Computer Account
Also known as:Computer Account
Active Directory Computer Account: Represents a domain-joined device as its own machine identity. The computer and domain use a periodically changed password for the secure channel; the account also receives Group Policy and can be granted permissions. Stale accounts, unsafe delegation, or compromised machine credentials can support lateral movement.
How it works and where it fits
Active Directory Computer Account separates the subject, digital identity, authentication factor, and authorization decision. Authentication establishes who or what is presenting an identity; authorization then determines which action is permitted in the current context. Session state, device trust, request origin, and risk signals can further influence that decision.
Practical security relevance
Effective implementation requires a controlled identity lifecycle from creation through role and entitlement changes to suspension and removal. Strong authentication, least privilege, periodic recertification, and traceable logs are central. Controls must also identify abuse of legitimate accounts, because valid credentials alone do not prove that an action is legitimate.
Related concepts
- Security PrincipalSecurity PrincipalIdentity with a security identifier to which permissions can be assigned and whose access Windows can evaluate.: Identity with a security identifier to which permissions can be assigned and whose access Windows can evaluate.
- Active Directory DomainActive Directory DomainLogical Active Directory partition with a shared directory database, namespace, policies, and domain controllers.: Logical Active Directory partition with a shared directory database, namespace, policies, and domain controllers.
- AuthenticationAuthenticationVerification of the claimed identity of a user or system.: Verification of the claimed identity of a user or system.
- Machine IdentityMachine IdentityDigital identity of a service, device, workload, or automated process.: Digital identity of a service, device, workload, or automated process.