Person Account
User accounts in Active Directory can only be created by ITS automatic provisioning infrastructure or by the Identity and Access Management Group.
NetID Accounts
The use of NetID accounts will be limited to non-privileged user activities such as accessing email, file shares, web browsers, workstations, and personal level application access. NetID accounts will not be granted administrative privileges on hosts or used to authenticate services or applications to Active Directory.
Privileged Accounts
All users who have elevated access to a system or service will have a secondary account used solely for tasks that require greater administrative access. The account will be tied to an individual user and that user will be responsible for keeping the account secure. The password for this account must follow the Network Password Requirements and cannot be the same as your personal account.
If available, the account should be stored in a University Controlled Password Manager.
(Should we put specific password requirements on these accounts?)
Vendor Account
A vendor account can be requested for a vendor only after a contract is in place. The account will follow the naming convention as established in the Privileged Access Standard and is limited to non-privileged user activities such as using the University VPN.
If the vendor will be doing work that requires privileged access they will be required to use a vendor administrative account using the established Privileged Access Standard. The account may only be used for the purpose it was created for.
(Should we put specific password requirements on these accounts?)
Non-person Accounts
A non-person account is created for a service, application or a group to gain access. The manager/owner of the account is responsible for the use of the account and (wording about renewals, expirations, etc).
Service Accounts
Service accounts are accounts that are designated for use for a particular service or application and have elevated privileges. A service account will be created for each function for a particular service or application, and should only be used for that purpose. The account should abide by the rules of least privilege as described by NIST.
Service accounts will be created and follow the naming conventions as established in the Privileged Access Standard.
If available, the account should be stored in a University Controlled Password Manager.
(Should we put specific password requirements on these accounts?)
Departmental Accounts
A departmental account is an account that is shared by a group to access department resources.
These accounts are not allowed any privileged access and are intended for use to access email, file shares, and web browsers.
Departmental accounts will not be granted administrative privileges on any system and should not be used to authenticate services or applications to Active Directory.
(Should we put specific password requirements on these accounts?)
Generic Accounts
A generic account is an account sponsored by an active University faculty or staff member and used by an individual not formally affiliated with the University.
These accounts are not allowed any privileged access and are intended for use to access such things as wikis, file shares, and web browsers.
Event Access Accounts
An event access account is an account that is shared by a group to access department resources for a short predefined period of time.
These accounts are not allowed any privileged access and are intended for use to file share, web browsers and workstations.
Event access account will not be granted administrative privileges to any system and should not be used to authenticate services or applications to Active Directory.
(Should we put specific password requirements on these accounts?)