Disable AD / Local User Accounts based on signals
C
Clay Eden
Would it be possible to disable user accounts associated with EDR detection?
We had an incident occur on a workstation where a domain user's account and then a domain administrator's account were used as part of an attack. It would be really handy if we could prevent additional lateral movement by disabling those accounts (in both cases of being a local computer user or a domain account).
Logic something like: Incident Occurs -> User Account issued command or action detected in signals -> User is Domain User -> Agent on AD Server for Same domain -> issue disable account (lock... similar to how ITDR propogates down a user lockout AD SYNC)
Also, maybe a roll back feature to re-enable them (similar to host isolation... un-isolated / unlock the user account?)
Thanks,
Clay
R
Ruben Castello
I strongly support this feature request. In fact, I believe this should be considered an essential capability for any serious Managed EDR/MDR solution.
We recently experienced a critical security incident in which Huntress successfully detected malicious activity and automatically isolated the affected endpoint. However, the associated Active Directory user account remained fully enabled.
This represents a significant security gap.
Isolating a compromised workstation does not necessarily stop an attacker if the associated credentials remain valid. Those credentials could still be used from another endpoint, through VPN, RDP, or other authentication services, potentially allowing lateral movement while the security team is still investigating.
Endpoint containment without identity containment is incomplete incident response.
Huntress should provide the ability to automatically disable or temporarily suspend associated AD/Entra ID accounts when high-confidence critical incidents are detected, with configurable policies, administrator approval options, session revocation, and rollback capabilities.
At the very least, this functionality should be available as an automated response option for MSPs and security teams.
In a real security incident, every minute matters. Waiting for manual intervention to disable an account creates an unnecessary window of exposure.
Please prioritize this feature. This is not simply a convenience or a nice-to-have improvement. It is a critical component of effective threat containment.