Application software providers sometimes require AD rights for service accounts to make it easier to test and deploy their products, even though significantly fewer rights are actually required for their operation. Additional rights for service accounts may be misused by attackers in order to access further areas of a domain. Since the credentials of a service that is executed in the context of a service account are stored in the protected memory of the Local Security Authority Subsystem (LSASS), an attacker may extract them there. A single weakly secured service account can thus result in an entire domain being compromised,

particularly if the service account is secured using a weak password. This is because an attacker using Kerberos authentication can easily request a TGS (Ticket Granting Service) ticket in which the password of the service account is processed. The password can then be broken offline using brute force.