Do You Know Your Active Directory Security Vulnerabilities?

By Sean Deuby March 18, 2021 | Active Directory

Securing Microsoft Active Directory (AD) involves dealing with a mixed bag of risks, ranging from management mistakes to unpatched vulnerabilities. We often write about the fact that cyber-attackers are targeting AD to elevate privileges and gain persistence in the organization. Investigate a typical data breach, and you’ll find that stolen credentials likely were used—sometimes for initial entry, sometimes for accessing critical systems, but always to the detriment of the targeted organization.

Hardening AD begins with getting a handle on the vulnerabilities and common configuration and management mishaps that pave the road to compromises. To defend AD, administrators need to know how attackers are targeting their environment. How many, however, can pass a pop quiz about the types of security holes threat actors are sneaking through as they move through the steps of the breach?

Authentication fail

Secure password policies should be the order of the day throughout the Active Directory infrastructure. It’s important to note these long-held security beliefs are changing, but when they change, they should change as a set. Specifically, user password expiration and rotation policies have been shown to weaken a password’s strength because humans fall into easily predictable patterns when forced to update regularly. However, these policies should not be changed until common passwords have been eliminated from the directory (perhaps using Azure AD Password Protection). Any account with the PASSWD_NOTREQD flag set should automatically draw additional scrutiny and have a justifiable reason for its configuration. 

The Zerologon vulnerability reported in 2020 was quickly exploited by attackers because it allowed them to change or remove the password for a service account on a domain controller. The results of a successful exploit could be catastrophic. Weak passwords, non-expiring passwords, no passwords—all these are warning signs that an organization’s AD environment is not secure.

Secure password policies should be the order of the day throughout the Active Directory infrastructure. Any account with the PASSWD_NOTREQD flag set should automatically draw additional scrutiny and have a justifiable reason for its configuration. Additionally, passwords—especially service account passwords—should be periodically rotated. Leaving passwords unchanged for lengthy amounts of time increases the likelihood of a successful brute force attack, as attackers will have more time to take swipes at them.

Authentication issues to watch for include:

  1. Computers and Group Managed Service Accounts (gMSA) objects with passwords set over 90 days ago
  2. Reversible passwords found in Group Policy Objects (GPOs)
  3. Anonymous access to Active Directory enabled
  4. Zerologon vulnerability (CVE-2020-1472) if the patch is not applied.

Permitting excessive permissions

As most AD environments have been in production for many years, their attack surfaces have grown. Many of a forest’s accumulated vulnerabilities can be traced back to the pattern that someone needs something done, usually in a hurry, and the leastprivilege path to get that done is too time consuming, not easily available, or simply not known. As a result, the user or group or permission is over-privileged just to ensure the request will be satisfied and the ticket closed. And of course, that entitlement is never ever removed, so the attack surface simply grows and grows.  

In reality, it’s not uncommon for AD environments to have unnecessarily high numbers of domain administrators—a fact that can be even more troubling if those accounts are orphaned and are simply waiting to be leveraged in an attack. Service accounts with excess permissions also pose a high risk because their passwords are usually set to not expire, and many of them will have weak passwords (which makes them a good kerberoasting target). As the number of users with administrative privileges grows, so does the attack surface that needs to be protected. Membership to these groups should be tightly controlled.

Mistakes happen, of course. As an AD environment grows larger and more complex, for example, someone might fail to properly account for inherited permissions and inadvertently grant an account too many privileges. But even properly managing privilege delegation is not enough with attackers taking the offensive.

As an example, consider the impact of an AdminSDHolder attack. Just as a refresher, the AdminSDHolder container stores the Security Descriptor applied to privileged groups. By default, every 60 minutes, the Security Description Propagation (SDPROP) process compares the permissions on protected objects and reverses any discrepancies according to what is defined in AdminSDHolder.

In an AdminSDHolder attack, threat actors exploit SDPROP to maintain persistence by replacing the permissions of an object with the attacker’s unauthorized modifications. If the permission changes are identified and undone, but the unauthorized changes to AdminSDHolder are undetected, the attacker’s changes will be reinstated.

Auditing permissions and monitoring for suspicious activity is the best defense against the abuse of privileges.

Permission issues to watch for include:

  1. Privileged objects with unprivileged owners
  2. Permission changes on the AdminSDHolder object
  3. Unprivileged users with DC Sync rights on the domain
  4. Default security descriptor schema changes in the last 90 days

Cheat sheet for security

Armed with information about indicators of exposure (IOEs), organizations can strengthen their AD’s security. One tool that can help is Purple Knight, a free security assessment tool that Semperis released in March. Purple Knight queries your Active Directory environment in “read-only” mode and performs a comprehensive set of tests against the most common and effective attack vectors to uncover risky configurations and security weaknesses.

Scanning Active Directory provides insight into its security posture and reduces the risk of unauthorized changes or misconfigurations going undetected. AD administrators need to know more than their craft; they also need to know the tactics of their adversaries. By keeping critical warning signs top of mind, they can harden AD against common attacks.


About the author
Sean Deuby
Sean Deuby Director of Services
Sean brings 30 years’ experience in enterprise IT and hybrid identity to his role as Director of Services at Semperis. An original architect and technical leader of Intel's Active Directory, Texas Instrument’s NT network, and 15-time MVP alumnus, Sean has been involved with Microsoft identity since its inception. Since then, his experience as an identity strategy consultant for many Fortune 500 companies gives him a broad perspective on the challenges of today's identity-centered security. Sean is an industry journalism veteran; as former technical director for Windows IT Pro, he has over 400 published articles on AD, hybrid identity, and Windows Server. Linkedin
Unlock cyber resilience. Get a demo