Based on best practice, which types of accounts should be disabled for interactive login?

The correct answer is D. Service accounts. Service accounts are created specifically to run applications, services, and automated processes - not for humans to log in interactively. Enabling interactive login for service accounts violates the principle of least privilege and increases the attack surface: if a service…

Submitted by jian89· Apr 18, 2026Protection of Information Assets

Question

Options

AConsole accounts
BAdministrator accounts
CLocal accounts
DService accounts

How the community answered

(58 responses)

A
2% (1)
B
5% (3)
C
2% (1)
D
91% (53)

Explanation

Service accounts are created specifically to run applications, services, and automated processes - not for humans to log in interactively. Enabling interactive login for service accounts violates the principle of least privilege and increases the attack surface: if a service account is compromised, an attacker could use it to log in directly and move laterally. Best practice (e.g., in Windows environments) is to deny interactive logon rights to service accounts. Console, administrator, and local accounts are all used by humans who may legitimately need interactive access, though administrator accounts should be used with caution.

Topics

#Service Account Security#Access Control#Security Best Practices#Account Management

Community Discussion

No community discussion yet for this question.

Full CISA Practice