Tech Log Entry--Local User Account Security Audit (Windows 11)

 

Local User Account Security Audit (Windows 11)

(Disabling Unused Accounts & the PostgreSQL Service Account)

1. Problem Identified

During IT coursework, the PowerShell cmdlet Get-LocalUser was used to audit all local user accounts on a Windows 11 home desktop. The results revealed an unexpected enabled account: postgres, a service account created by a prior PostgreSQL database installation. PostgreSQL had been briefly installed for coursework purposes, then uninstalled — but the uninstaller process left the user account behind in an enabled state. No PostgreSQL service or processes were found to be running at the time of discovery.

2. Investigation & Learning

The following PowerShell commands were used to investigate the system's account and service state:

• Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordLastSet

• Get-Service -Name postgresql*

• Get-Service | Where-Object { $_.DisplayName -like "*postgres*" }

• Get-Process | Where-Object { $_.Name -like "*postgres*" }

Key finding: The uninstaller had removed the PostgreSQL service and all running processes, but left the postgres local user account itself as present and enabled. An enabled account with no active service still represents an unnecessary attack surface — a potential target for brute-force attacks or lateral movement if another vulnerability is exploited.

3. Solution & Steps Taken

The account was disabled using an elevated (Administrator) PowerShell session:

• Disable-LocalUser -Name "postgres"

Disabling (rather than deleting) was the correct approach: it preserves the account's SID and permissions for future use, and avoids conflicts if PostgreSQL is reinstalled. Re-enabling is trivial: Enable-LocalUser -Name "postgres".

4. Security Context & Broader Lessons

This exercise illustrates several core security principles:

• Principle of Least Privilege: Accounts and services should only be active when actively needed. Every enabled account is a potential entry point.

• Software Installers Leave Residue: Uninstallers frequently leave behind user accounts, registry entries, and scheduled tasks. Post-uninstall audits are good practice.

• Audit Regularly: Periodic use of Get-LocalUser can catch accounts silently created by software updates, game clients, or remote management tools.

• Disable, Don't Delete: For service accounts, disabling preserves the account for future reinstallation while eliminating the attack surface.

• NIST Password Guidance: Strong, unique passwords (20+ characters, mixed character classes, non-dictionary) do not require scheduled rotation — change only when there is cause.

5. Future Tasks & Calendar Reminders

• December 2026 — Re-enable postgres and resume PostgreSQL study: Run Enable-LocalUser -Name "postgres", reinstall PostgreSQL fresh, and pick up database coursework. Verify pg_hba.conf restricts connections to localhost only, and confirm a strong unique password is set for the postgres DB superuser.

• Ongoing — Periodic account audit: Run Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordLastSet every few months to catch new or unexpectedly re-enabled accounts.

• Ongoing — Service startup audit: After any major software install or update, run Get-Service | Where-Object { $_.StartType -eq 'Automatic' } to ensure no unwanted services are set to auto-start.