Question
Is there a "correct" / standard way to distinguish Service Accounts
from User Accounts
in AD?
More Info
In certain scenarios we have systems running under AD Credentials (i.e. under a Service Account). These Service Accounts are created in exactly the same way as user accounts; the only difference being the name and description. A few things have been done to make a distinction between the two account types (e.g. which OU the account is in, whether "password never expires" is enabled, if "service account" is in the description), but there's no one rule which can be applied to everything to clearly distinguish between the two.
Going forwards we're looking to improve this / spring clean things to make a distinction clear. We'll likely use both the OU and Description fields for this purpose.
Before doing this though I wanted to check; is the a way in which this should be done; i.e. some attribute specifically for this purpose (maybe an objectCategory value different to Person?), or a recognised standard naming convention, or does each company figure out their own approach?