Forgotten And Undecommissioned Systems
How Forgotten And Undecommissioned Systems works
Forgotten systems are hosts that outlived their purpose and their owner but were never switched off. They are migration leftovers still answering on the old address, test copies of production databases restored for a cutover and kept just in case, retired application servers still powered on because nobody would sign the change to stop them, and name records pointing at machines with no maintainer. Half of them are in the inventory: the record exists, the owner field names somebody who left, and the last patch predates the migration that was supposed to replace the host.
What the attacker gets is a machine with production data and production trust but none of the current controls: an operating system frozen at its last maintenance window, cached credentials from the accounts that administered it, service accounts still valid in the domain, firewall rules still open to it, and no monitoring because nobody expects traffic there. It is easy to miss because decommissioning is unfunded work with no deadline. Powering something off carries risk and delivers no visible benefit, so it is deferred, and each deferral makes the host older and less understood. Reviews look at what is being built, never at what quietly stopped being used.
Forgotten And Undecommissioned Systems in practice
Rank the estate by evidence of neglect
The cheapest first pass uses management data you already hold. Two lists matter: hosts that are alive with no owner, and objects that stopped rotating.
# Alive on the domain but with nobody recorded against them
Get-ADComputer -Filter * -Properties LastLogonDate, PasswordLastSet, OperatingSystem, Description, ManagedBy |
Where-Object { $_.LastLogonDate -gt (Get-Date).AddDays(-30) -and
(-not $_.ManagedBy -or -not $_.Description) } |
Select-Object Name, OperatingSystem, LastLogonDate, PasswordLastSet, Description |
Export-Csv C:\audit\unowned-live.csv -NoTypeInformation
# Machine passwords that stopped rotating: powered off, broken, or off the domain
$cut = (Get-Date).AddDays(-90)
Get-ADComputer -Filter * -Properties PasswordLastSet |
Where-Object { $_.PasswordLastSet -lt $cut } |
Sort-Object PasswordLastSet |
Select-Object Name, PasswordLastSet |
Export-Csv C:\audit\stale-computer-objects.csv -NoTypeInformationCleaning up the directory objects themselves belongs to the Stale And Orphaned Accounts page. Here each object is only a pointer to a physical or virtual machine that may still be running.
Confirm the host is alive and measure how long it has been ignored
Uptime and patch age are the two numbers that turn a suspicion into a finding.
# Read-only fingerprint and clock evidence from the network side
nmap -O --script smb-os-discovery,smb2-time -p 445 \
-oN /tmp/legacy-app01.txt legacy-app01.lab.internal
# Where you hold authorised read-only access, take the evidence directly
ssh -o PreferredAuthentications=publickey audit@legacy-app01.lab.internal \
'uptime -p; head -2 /etc/os-release; ls -l --time-style=long-iso /var/log/dpkg.log* | tail -3'
# A web front end that still answers is still an attack surface
curl -skI https://legacy-app01.lab.internal/ | head -5What the operating system version implies for support and patching is the End-Of-Life Operating Systems page’s material; here it is only an age signal.
Trace ownership before proposing that anything be switched off
A host with no owner still leaves fingerprints. Collect them so the decommissioning request names the people it will affect.
# Names still pointing at the address
dig @dns01.lab.internal +short -x 10.20.60.14
grep -i '10.20.60.14' /tmp/dns-zone-export.txt
# Certificates name the service and often the requester
echo | openssl s_client -connect legacy-app01.lab.internal:443 2>/dev/null \
| openssl x509 -noout -subject -issuer -datesThen pull successful logons for the host from the SIEM over the last 90 days. No interactive logons and only monitoring accounts means a decommission candidate; daily logons by real users mean the host has an undocumented owner who has to be named before anything moves.
Report it as a decommissioning decision, not as a host list
The deliverable is a disposition per host, because a list of old machines produces no action.
HOST / RECORD OS PATCH AGE UPTIME OWNER LOGONS/90d DISPOSITION
legacy-app01 RHEL 6 6y 1284d none 0 isolate, soak, wipe
mig-sql-copy02 Windows 2012 R2 4y 612d none 2 (service) prod data copy: wipe first
uat-portal03 Windows 2016 1y 210d departed 41 reassign owner, patch
old-crm (A record) - - - none - dangling: remove recordThe finding is not that a host is old. It is that the host has no owner, holds production data, answers on the network, and no process exists that would ever remove it.
How to fix and prevent Forgotten And Undecommissioned Systems
- Give every asset an owner and a review date at creation
- No hypervisor clone, project VLAN or migration copy is built without a named technical owner and an expiry; a missing owner blocks the change rather than becoming a to-do.
- Review the neglect signals on a schedule
- Sort monthly by uptime, patch age, last logon and last agent check-in, and require the named owner to confirm continued need in writing.
- Silence from an owner is a decommission trigger, not an approval.
- Make decommissioning a defined process that produces evidence
- Isolate, soak for a defined period, snapshot, wipe media, then remove DNS records, certificates, firewall rules, backup jobs, monitoring checks and licences before closing the record.
- Media handling and disposal detail belongs to the Insecure Media Disposal And Decommissioning page; retain the wipe and removal evidence as the proof the asset is gone.
- Treat a migration as unfinished until the source is gone
- Fund and schedule removal of the source system inside the migration project. Deferred decommissioning is never funded afterwards.
- Reconcile name records and certificates against live hosts
- Records resolving to addresses nothing answers on, and certificates issued for names no longer in service, are removed on the same cycle as the hosts themselves.
Last updated
