An unused user account with an attractive administrative name, such as MSSQL_Admin, is an effective honeytoken because attackers commonly target apparent privileged accounts during reconnaissance. A false password in an easily discovered directory attribute can entice an attacker to attempt authentication; any use of the unused account is a strong indicator of malicious activity. Microsoft Defender for Identity guidance states that honeytoken accounts should remain unused and have an attractive name, such as SQL-Admin.
Community Discussion