Local Admin Account Used After Contractor Offboarding

Contain first without destroying evidence: disable the local account, revoke active sessions, rotate credentials and service accounts that the account could reach, and restrict network access to the CommServe and MediaAgents. Preserve the CommServe audit trail, security logs, job history, and relevant MediaAgent logs, and take a protected snapshot or image of the CommServe before making broad changes. Preserve IdP logs, VPN or remote-access logs, and S3 access logs or CloudTrail events. The audit trail shows which Commvault account performed an action, not which human used it. If the local account was shared or not tied to MFA, the audit trail cannot prove identity. Correlate source IPs, session times, IdP events, and endpoint logs. A 30-day audit retention may be too short for the investigation and legal requirements, so export and preserve the relevant records now. Do not overwrite the DR backup or the S3 objects while investigating.

Governance-mode Object Lock can be bypassed by an identity with the specific bypass permission, so an attacker with sufficient S3 administrative rights may be able to delete or shorten retention. Compliance mode cannot be bypassed by any user, including root, until the retention period expires. A 30-day retention may be shorter than the investigation, legal-hold, or regulatory period, so it may not preserve the needed copies. Versioning helps against simple overwrite but does not replace immutable retention. The 9-day-old CommServe DR backup means a restore could lose up to 9 days of CommCell configuration and job metadata; that is a separate recovery gap. The remaining risk is that the attacker had enough privilege to modify the storage policy or the S3 configuration itself. Verify whether the deleted auxiliary copy was protected by Object Lock, whether versioning retained the objects, and whether the DR backup can be restored and validated in an isolated environment.

Reduce the 14 local CommCell Administrator accounts to a small break-glass set with MFA, and map normal administration through SAML groups with least privilege. Separate roles for backup administration, restore, policy management, and security audit; do not let one role both delete copies and change retention. Review security associations and tenant boundaries so administrators see only the clients and data they need. Disable unused local accounts and alert on local-account use. For legal hold, apply it at the custodian or item level in the compliance search and hold workflow, not only to a subclient name. A subclient can be renamed, deleted, or restructured, which can make the hold appear ineffective. Confirm the hold scope includes all relevant mailboxes, OneDrive or file data, and backup copies, and that retention does not expire while the hold is active. Test by searching for held items after a policy change, document the hold, and audit who can release it. Legal hold does not replace immutable backup copies, and immutable copies do not replace a properly scoped hold.