What breaks when Active Directory controls are managed only through quarterly reviews?

Quarterly reviews miss the drift that matters most. Service accounts gain access, delegation is expanded, and nested groups accumulate privilege between review cycles. By the time the next review happens, an attacker may already have used the path. Continuous discovery and risk-based remediation are needed because AD exposure changes faster than formal governance cadences.

Why This Matters for Security Teams

Quarterly review cycles create a false sense of control because active directory exposure changes continuously, while the review is only a snapshot. Between checkpoints, service accounts are delegated, nested groups expand, and inherited rights spread in ways that are easy to miss in spreadsheets or ticket queues. That gap matters because identity abuse is still one of the fastest paths to lateral movement, and NHI drift often becomes visible only after an incident. NHI Mgmt Group research shows that 97% of NHIs carry excessive privileges, which makes delayed review cycles especially dangerous when the environment is already over-entitled. The practical lesson is simple: governance that is not paired with discovery, alerting, and remediation is only documentation, not control. NIST’s NIST Cybersecurity Framework 2.0 reinforces that identity risk management has to be ongoing, not periodic, because asset and access conditions change faster than formal governance rhythms. For teams using AD to anchor service identities, the real failure is not the review itself, but the assumption that a quarterly snapshot can keep pace with daily privilege drift. In practice, many security teams discover the dangerous path only after a service account has already been used to move laterally or persist quietly for weeks.

How It Works in Practice

Quarterly reviews usually start with a list of accounts, groups, and owners, then compare that list against policy. The problem is that AD does not remain static long enough for that model to work. A service account may gain a new group membership for a deployment, inherit access through a nested group, or receive delegation for an emergency change, and none of those steps is inherently visible at the next review unless the team also tracks effective permissions in real time. That is why current guidance increasingly pairs periodic attestation with continuous discovery, risk scoring, and remediation workflows.

• Track effective access, not just assigned membership, because nested groups can hide privilege.
• Monitor service accounts and privileged identities separately, since their blast radius is usually larger than human accounts.
• Use short-lived credentials and rotation where possible, because long-lived secrets extend the compromise window.
• Correlate AD changes with ticketing, CMDB, and authentication logs so drift is caught before the next review.

The lifecycle view from Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs and the practical guidance in NHI Lifecycle Management Guide both point to the same operational conclusion: identity control has to follow the full lifecycle, not only the quarterly attestation point. For a breach example, the Cisco Active Directory credentials breach illustrates how exposed directory credentials can become a durable foothold once they are copied or reused. NIST CSF 2.0 and NIST Cybersecurity Framework 2.0 both support this operational shift toward continuous monitoring and timely response. These controls tend to break down in large AD forests with delegated administration and heavy group nesting because effective privilege changes faster than the review evidence can be collected.

Common Variations and Edge Cases

Tighter review cadences often increase administrative overhead, requiring organisations to balance assurance against the cost of collecting, validating, and remediating identity data more frequently. That tradeoff is real, but quarterly-only governance is still too slow for environments with high change velocity. In highly regulated shops, the review may satisfy audit evidence while still missing operational risk, so current guidance suggests using reviews as a backstop rather than the primary defense. The same is true in hybrid estates where on-prem AD feeds cloud apps: a stale group in one directory can propagate access into many services even after the original reviewer signs off.

There is no universal standard for exactly how often each AD entitlement should be revalidated, but best practice is evolving toward risk-based schedules. High-privilege service accounts, domain admin paths, and accounts tied to production automation should be monitored continuously, while lower-risk entitlements can remain on a periodic attestation cycle. The broader NHI issue is captured in Top 10 NHI Issues and the governance framing in Ultimate Guide to NHIs — Regulatory and Audit Perspectives, where the emphasis is on visibility, rotation, and offboarding rather than periodic reassurance alone. In practice, quarterly review programs fail most often in environments with shared service accounts, delegated OU administration, or poor ownership records because no one can prove what changed between cycles.

Related resources from NHI Mgmt Group

• How should security teams govern Active Directory service accounts?
• How should security teams run access reviews for non-human identities?
• When do NHI access reviews create more value than a one-time cleanup?
• What is the difference between human IAM controls and NHI governance?