Tech Log Entry--Local User Account Security Audit (Windows 11)
Local User Account Security Audit (Windows 11) (Disabling Unused Accounts & the PostgreSQL Service Account) 1. Problem Identified During IT coursework, the PowerShell cmdlet Get-LocalUser was used to audit all local user accounts on a Windows 11 home desktop. The results revealed an unexpected enabled account: postgres , a service account created by a prior PostgreSQL database installation. PostgreSQL had been briefly installed for coursework purposes, then uninstalled — but the uninstaller process left the user account behind in an enabled state. No PostgreSQL service or processes were found to be running at the time of discovery. 2. Investigation & Learning The following PowerShell commands were used to investigate the system's account and service state: Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordLastSet Get-Service -Name postgresql* Get-Service | Where-Object { $_.DisplayName -like "*postgres*" } Get-Process | Where-Object { $_.Name -li...