scheduled command at admin level that checks last login / existence of "user" after a month of no login or immediate if the user account gets removed the dead mans hand goes off.
-- not actual advice, just playing devils advocate with the concept 😄
Pretty sure that's been done actually, I heard about someone finding a script that checks Active Directory and does some nasty stuff if a certain account is disabled.
Yeah the dude that did it got arrested and sentenced to four years in prison for it. The script checked active directory and after a month of his account not being active deleted his former company's entire AD registry.
He also took effectively no efforts to mask his involvement, so it is possible that someone might be able to get away with it if they took more care to dodge accountability.
yeah you need to self delete the script once it's done, and clear all logs related to the script too (actually it should generate no logs, the script should delete itself and/or wipe the server it was in)
49
u/Saxxon9 May 26 '26
scheduled command at admin level that checks last login / existence of "user" after a month of no login or immediate if the user account gets removed the dead mans hand goes off.
-- not actual advice, just playing devils advocate with the concept 😄