Shared Accounts and Attribution
A shared administrative account means no record of who did anything. The migration to individual accounts is the least glamorous work with the largest audit effect.
Procedure
Attribution is the ability to say which person performed an action. Shared privileged accounts remove it entirely, and they are everywhere.
Why shared accounts persist
The system does not support individual accounts, which is genuinely true for some appliances and older applications.
They predate any policy and nobody has counted them.
Licensing, where a vendor charges per named administrator.
Convenience during incidents, when everyone needs to act quickly.
Automation uses them, and disentangling which script depends on which credential is real work.
What is lost
Who did it. After an incident, the log says the administrative account made a change and nothing more.
Deterrence. People behave differently when actions are attributable, which is a large part of the value of PAM and rarely stated.
Offboarding. A leaver who knew the password still knows it, and rotation is the only remedy.
Access review. You cannot review who has access when access is knowledge of a string.
Compliance evidence, in most frameworks that address privileged access at all.
The migration
Inventory the shared accounts, and for each, who knows the credential and what depends on it.
For each, determine whether individual accounts are possible. Many systems support it and were configured with a shared account years ago out of habit.
Where possible: create individual accounts, migrate, and disable the shared one after a monitoring period rather than immediately.
Where impossible: vault it and broker sessions, so checkout provides the attribution the system cannot.
Rotate after every checkout for the highest-tier shared accounts, which limits the value of a captured credential.
The automation problem
The hardest part of the migration.
Scripts and jobs using the shared credential break when it rotates or is disabled.
Nobody knows the complete list, because it accumulated over years.
Approach: enable failure logging on the account before changing anything, run for a period, and collect what authenticates.
Then migrate each dependency to its own service account, with its own credential and its own rights.
This takes months and it is the work that makes rotation possible at all.
Break-glass accounts
The deliberate exception, which needs its own treatment.
Every environment needs a route in when the normal one fails.
Documented: which system, where the credential is held, who may retrieve it.
Alerting on use, to someone other than the person who retrieved it.
Rotated after every use.
Tested, on a schedule, because an untested break-glass procedure fails at the worst moment.
Reviewed annually, because these accumulate and quietly become ordinary accounts nobody remembers are privileged.
Measuring progress
Count of shared privileged accounts, by tier, tracked over time.
Proportion of privileged authentications attributable to a named person.
Shared accounts with unknown dependencies, which should trend to zero as the logging work completes.
Time since last rotation for each remaining shared account, which is the risk that accumulates while the migration runs.
Enabling the dependency log
The step that unblocks every shared account migration, and it takes a quarter.
Enable authentication logging for the shared account before changing anything.
Run for a full quarter, to catch monthly and quarterly jobs.
Collect source hosts, processes and times.
Group by source to identify the owning team.
Contact each owner and agree a migration to a dedicated identity.
Keep the log running through the migration, so anything missed surfaces as a failure you can attribute rather than as an unexplained outage.
The licensing objection
Some vendors charge per named administrator, which is a real reason shared accounts persist.
Cost the alternative properly: the licence difference against the audit exposure and the offboarding risk.
Negotiate at renewal, with the compliance requirement stated. Vendors frequently have an arrangement for this and do not volunteer it.
Where the cost is genuinely prohibitive, vault the shared account and broker every session, so checkout provides the attribution the licence does not.
Record it as an accepted risk with the reason, the compensating control and a review date.
Do not leave it undocumented, which is what usually happens and what an auditor finds.