New Check: Timeroasting (Inactive Managed Service Accounts)

What is a one sentence summary of your feature request?

Uncover Inactive Managed Service Accounts (MSA) that could be suseptible to timeroasting

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

PingCastle already covers Timeroasting indirectly via the Inactive Computers and Inactive Trusts rules however Managed Service Accounts (MSAs) are not covered.

Add a new rule to check for Inactive Managed Service Accounts and update the text and links in the Inactive Computers and Inactive Trusts rules to reference timeroasting.

How do you currently solve the challenges you have by not having this feature?

Use PowerShell or other tooling.

Thanks for the idea Brandon. Inactive Managed Service Accounts totally makes sense to check not only for Timeroasting risks but also general Active Directory health.