Search/ GitHub
PW-004Attack pathControl and privilege paths

Tier Zero account logged on to computers outside Tier Zero

A Domain Admin or other Tier Zero account has signed in to ordinary servers or workstations, leaving its credentials behind.

Category
Attack Path
Severity
At least High.
Typical owner
AD / identity team together with the admins who own the account
Data needed
Logon sessions, which only SharpHound (or the built-in collector* with --user --scope all) collects. Check Collection completeness on the report's Collection tab: computers whose sessions weren't collected can hide this finding.
MITRE ATT&CKT1003.001
Most useful toDefensive engineersIdentity and access engineersOffensive operators
On this page

In plain language

When someone signs in to a Windows computer, their credentials are kept in that computer's memory for the length of the session, and sometimes longer. Anyone who is a local administrator on that computer can take them.

So when a Domain Admin signs in to an ordinary server "just to check something", every administrator of that server, and every attacker who becomes one, can become a Domain Admin. In real intrusions this is one of the most common routes to domain compromise, and in Pathwarden's remediation path it is often the first plan step.

What Pathwarden flags

A Tier Zero account (for example a Domain Admin) had a session on servers or workstations outside Tier Zero. While logged on, and often afterwards, its credentials are in that computer's memory, so anyone with admin rights on the computer can take them.

How attackers use it

Attackers who gain local admin on any listed computer dump LSASS or steal Kerberos tickets (OS Credential Dumping: LSASS Memory, T1003.001) and immediately become Domain Admin. This is one of the most common paths in real intrusions and pentests, and usually the biggest choke point in the report's Remediation path tab.

Find it with Pathwarden

Data needed: Logon sessions, which only SharpHound (or the built-in collector* with --user --scope all) collects. Check Collection completeness on the report's Collection tab: computers whose sessions weren't collected can hide this finding.

In the web UI or the HTML report, open the Findings tab and expand PW-004: each finding shows who can use it (its exposure), the attack path drawn out, the affected objects, and the fix. The remediation path tells you whether a single plan step closes it. On the command line:

Shell
# every finding of this rule, with its path and fix
pathwarden findings -i .\collect --rule PW-004
# the step-by-step guide on this page, offline
pathwarden guide PW-004
# after the fix: collect again, then check it is gone
pathwarden retest -i .\collect-after --rule PW-004

Exit codes make retest easy to script: 0 Fixed, 1 Still open, 3 Can't tell. See findings lifecycle and retest.

Before you change anything

  • Ask the account owner why they log on to those computers (RDP, scheduled task, service, mapped drive). Event 4624 on the computer shows logon type: 2/10 interactive or RDP, 3 network, 4 batch, 5 service.
  • Services or scheduled tasks running as a Tier Zero account must be moved to a dedicated, non-privileged service account (or gMSA) first, or they will break.
  • Make sure each admin has a separate, non-Tier Zero account for daily work.

How to fix it

  1. Give the admin a normal account for workstations and a Tier 1 account for servers if needed.
  2. In Group Policy Management, edit a GPO linked to all non-Tier Zero computers: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
  3. Add the Tier Zero groups (Domain Admins, Enterprise Admins, Schema Admins) to Deny log on locally, Deny log on through Remote Desktop Services, Deny log on as a batch job and Deny log on as a service. Deny access to this computer from the network also stops network sign-ins, but it blocks remote administration of those computers with Tier Zero accounts as well.
  4. Log off the account on the listed computers, or reboot them, to clear cached credentials. If any of them may have been compromised, change the account's password.

Option B: Authentication Policy Silos

  1. In Active Directory Administrative Center > Authentication, create an authentication policy and silo that allows Tier Zero accounts to authenticate only from Tier Zero computers (requires Windows Server 2012 R2+ domain functional level).
  2. Assign the accounts and Tier Zero computers to the silo; test in audit mode first.

Option C: Protected Users

Add the account to Protected Users: no NTLM, no delegation, no cached credentials, 4-hour TGTs. Test first: it breaks NTLM-only apps for that account.

PowerShell

PowerShell
Import-Module ActiveDirectory

# Where has the account logged on recently? (run on a computer from the finding)
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4624 } -MaxEvents 2000 |
    Where-Object { $_.Properties[5].Value -eq '<Account>' } |
    Select-Object TimeCreated, @{ n = 'LogonType'; e = { $_.Properties[8].Value } }

# Services and scheduled tasks running as the account on a computer
Get-CimInstance Win32_Service -ComputerName <Computer> | Where-Object StartName -like '*<Account>*'
Get-ScheduledTask -CimSession <Computer> | Where-Object { $_.Principal.UserId -like '*<Account>*' }

# Add the account to Protected Users (after testing)
Add-ADGroupMember -Identity "Protected Users" -Members "<Account>"

Verify the fix

After the deny rights apply (gpupdate /force, or the next refresh), a logon attempt by the Tier Zero account on a listed computer must fail. Collect again (or use Retest on the finding) and confirm the finding ID is gone.

Roll back

Remove the groups from the Deny user rights in the GPO (or unlink it) and run gpupdate /force; remove the account from Protected Users with Remove-ADGroupMember "Protected Users" -Members "<Account>".

References

  1. Microsoft: Protected Users security grouplearn.microsoft.com
  2. Microsoft: Authentication policies and authentication policy siloslearn.microsoft.com
  3. SpecterOps BloodHound docs: HasSessionbloodhound.specterops.io
  4. Microsoft: Enterprise access model (privileged access tiers)learn.microsoft.com
  5. MITRE ATT&CK T1003.001: OS Credential Dumping: LSASS Memoryattack.mitre.org

Very new and undergoing testing. These features haven't received a lot of testing yet. Try them out and let us know what's working.

↑↓ to moveEnter to openEsc to close