An unauthorized account is a user profile created or enabled without approval from the organization responsible for a system. It may be added by an intruder to maintain access after an initial compromise, or result from poor account management. On cameras, video recorders, servers, and other devices, it can grant access that legitimate administrators did not intend.
Unexpected accounts matter because they can persist even after the original entry point is closed. During an investigation, defenders should review local and remote user lists, confirm each account has an owner and a valid purpose, remove unapproved profiles, and rotate credentials as appropriate. They should also check permissions and audit logs, since an account’s presence alone does not establish what it accessed or how it was created. Restricting management interfaces, using unique strong credentials, and monitoring account changes can help prevent or detect this form of persistence.