Active Directory tends to accumulate mess quietly. Someone leaves the company and their account isn't disabled. A contractor gets temporary admin rights for one project and keeps them for two years. A security group gets created for a one-off task and never gets cleaned up. None of it looks dramatic day to day — but it's consistently one of the first things auditors and penetration testers find.
What "AD hygiene" actually covers
- Stale accounts — accounts for former employees or contractors that were never disabled or removed.
- Privilege creep — users who've accumulated access from old roles or projects that no longer matches their current job.
- Orphaned groups — security groups created for a specific purpose that outlived that purpose, still granting access to whoever's in them.
- Password and authentication policy drift — inconsistent enforcement across different organizational units.
- Service account sprawl — non-human accounts with broad permissions and passwords that rarely, if ever, get rotated.
Why this is a compliance issue, not just a tidiness issue
Frameworks like SOC 2, ISO 27001, HIPAA, and PCI-DSS all include some version of an access control requirement — the principle that people (and systems) should only have the access they actually need, and that access should be reviewed and removed when it's no longer needed. A messy Active Directory environment is often the clearest evidence that access reviews aren't actually happening in practice, whatever the written policy says.
Getting from messy to managed
The fix isn't a one-time cleanup — a single audit and remediation project will drift right back into the same state within a year without an ongoing process. What actually holds up over time is a recurring access review cadence (quarterly is common), automated deprovisioning tied to HR offboarding rather than a manual IT ticket, and periodic audits of group memberships against what each group is actually supposed to grant.
Where tooling helps
Dedicated AD management tools can automate a lot of this — flagging stale accounts, reporting on privilege changes, and enforcing consistent policy across the environment — turning what's often a manual, easy-to-skip process into something that runs on its own schedule.