Search/ GitHub
PW-025Attack pathTrusts, management planes and other systems

Tier Zero computers managed by a system outside Tier Zero

A management system that controls domain controllers or CA servers, such as Entra Connect or SCOM, hasn't been made part of Tier Zero.

Category
Attack Path
Severity
At least High.
Typical owner
AD / identity team, with the owner of the management system (SCCM, SCOM, Entra Connect)
Data needed
Directory data from any collection: the Entra Connect sync account and its description, and SCOM's AD integration groups under CN=OperationsManager.
MITRE ATT&CKT1072
Most useful toDefensive engineersIdentity and access engineersOffensive operators
On this page

In plain language

Tier Zero isn't only domain controllers and admin groups. Anything that can control them is Tier Zero too: the server that runs Entra Connect (it holds an account that can download every password hash), or a SCOM management server that can run code on the domain controllers it monitors.

These systems are often run by another team, administered from ordinary workstations and left out of hardening. Pathwarden detects them from directory data* and asks you to decide: declare them Tier Zero and protect them as such, or stop them managing Tier Zero.

What Pathwarden flags

A management system controls Tier Zero, but it wasn't declared Tier Zero. Pathwarden finds three kinds today, from directory data alone:

  • An Entra Connect server. The Entra Connect sync account (MSOL_...) holds both directory replication rights, so it can DCSync. Its password is stored on the server that runs Entra Connect, which the installer names in the account's description ("running on computer AADC01"). A server that can read the password of the sync service account (ADSyncMSA...) holds it too: that account's key decrypts the stored credentials. Whoever controls that server can read the password and DCSync the domain.
  • A SCOM management server whose agents include domain controllers or CA servers. With SCOM's AD integration, the agents assigned to a management server are members of a group under CN=OperationsManager. A SCOM management server (and every SCOM administrator) can run code as SYSTEM on its agents. Pathwarden adds a ManagesHost relationship from the server to each Tier Zero agent.
  • The SCCM site server of a domain controller or CA server. The computer has the CmRcService/ service principal name, which the SCCM Remote Control service registers on clients, and the forest has a single site server (Full Control of CN=System Management). A site server can run code as SYSTEM on every client, so Pathwarden adds a ManagesHost relationship from it to the computer. This is inferred: with several site servers, or none, PW-028 asks you to check instead. With the built-in collector, a GPO that pushes the SCCM client also shows the computer is a client, and SCCM's site objects pick the site server of the client's site among several.
  • The WSUS server of a domain controller or CA server. A GPO that applies to the computer sets the WSUS server (WUServer with UseWUServer, in its Machine\Registry.pol), and the server is a computer in the collection. Whoever controls it can approve a malicious "update" for the computer. Inferred: a WMI filter or security filtering may keep the GPO off the computer. Built-in collector only; with SharpHound data it is not read, and this finding is held, not fixed.

Pathwarden treats these systems as Tier Zero as soon as it finds them, so PW-003 reports who controls them and the remediation path counts every route to them. This finding stays open until you decide: declare the system Tier Zero, or stop it managing Tier Zero.

If the sync account's server can't be identified, the finding is raised on the account ("The Entra Connect server of MSOL_... is not identified").

How attackers use it

Management planes are the shortest way around tiering. Local admin on an Entra Connect server gives the sync account's password (AADInternals and similar tools decrypt it in one command), and with it DCSync. Control of a SCOM or SCCM server gives code execution as SYSTEM on every managed computer, domain controllers included, through the product's own deployment features. These servers are often run by a separate team, administered from ordinary workstations, and left out of Tier Zero hardening.

Find it with Pathwarden

Data needed: Directory data from any collection: the Entra Connect sync account and its description, and SCOM's AD integration groups under CN=OperationsManager.

In the web UI or the HTML report, open the Findings tab and expand PW-025: each finding shows who can use it (its exposure), the attack path drawn out, the affected objects, and the fix. The remediation path tells you whether a single plan step closes it. On the command line:

Shell
# every finding of this rule, with its path and fix
pathwarden findings -i .\collect --rule PW-025
# the step-by-step guide on this page, offline
pathwarden guide PW-025
# after the fix: collect again, then check it is gone
pathwarden retest -i .\collect-after --rule PW-025

Exit codes make retest easy to script: 0 Fixed, 1 Still open, 3 Can't tell. See findings lifecycle and retest.

Before you change anything

  • Confirm the evidence in the finding:
    • Entra Connect: on the named server, open the Synchronization Service Manager (or run Get-ADSyncConnector) and check that it uses this account. A description from an old installation can name a server that no longer runs Entra Connect.
    • SCOM: in the Operations console, Administration > Agent Managed, check that the domain controllers report to this management server.
    • SCCM: on the domain controller, Configuration Manager in the Control Panel shows the client and its site; check that the site belongs to this site server.
  • Find out who administers the system today: local Administrators of the server, the product's own administrators (SCOM Administrators, SCCM Full Administrators), and who can sign in to it. Those are the people and groups that become Tier Zero in Option B.
  • If the detection is wrong (the server was retired, the group is stale), record that in the settings (see Rollback) instead of ignoring the finding.

How to fix it

Option A: Stop the system managing Tier Zero (best for SCOM and SCCM)

  1. SCOM: remove the domain controllers and CA servers from the AD integration assignment rule (Operations console, Administration > Management Servers, the server's Properties > Auto Agent Assignment), uninstall the agent from them, or monitor them from a management group that is itself run from Tier Zero.
  2. SCCM: uninstall the client from Tier Zero computers (`ccmsetup.exe /uninstall`) and exclude them from client push and boundary groups, or manage them from a dedicated site run from Tier Zero.
  3. Collect again: the ManagesHost relationship and this finding disappear.

Option B: Make the system Tier Zero (usual for Entra Connect)

  1. Add the server (for example AADC01.SCALE.LOCAL) under Additional Tier Zero in Settings.
  2. Treat it like a domain controller: only Tier Zero admins may sign in to it or administer it, it is patched and monitored like a DC, and it has no agents or software run by lower tiers (backup, monitoring, EDR consoles run from Tier 1).
  3. Fix what PW-003 then reports: every account or group outside Tier Zero that controls the server (local admins, delegated rights on its computer object, GPOs that apply to it).
  4. For Entra Connect, follow Microsoft's hardening guidance for the server, and prefer a gMSA or a dedicated account per forest for the connector.

PowerShell

PowerShell
# Entra Connect: the server each sync account names, and when it last signed in
Get-ADUser -Filter 'SamAccountName -like "MSOL_*"' -Properties Description, LastLogonDate |
    Select-Object SamAccountName, LastLogonDate,
        @{n='Server'; e={ if ($_.Description -match 'running on computer (\S+)') { $Matches[1] } }}

# Who is local administrator on the server (run on the server)
Get-LocalGroupMember -Group Administrators

# SCOM AD integration groups and their members
$om = "CN=OperationsManager," + (Get-ADDomain).DistinguishedName
Get-ADGroup -SearchBase $om -Filter * |
    ForEach-Object { [pscustomobject]@{ Group = $_.Name; Members = (Get-ADGroupMember $_ | ForEach-Object Name) -join ', ' } }

Verify the fix

Collect again. With Option A, the domain controllers are no longer agents and the finding is gone. With Option B, the server is listed as "Configured as Tier Zero", the finding is gone, and PW-003 shows no remaining non-Tier Zero control of it.

Roll back

  • Option A: reinstall the agent or restore the assignment rule.
  • Option B: remove the server from Additional Tier Zero in Settings.
  • If Pathwarden's detection is wrong, mark the object as not Tier Zero in the settings. It is then not treated as Tier Zero; if it still manages Tier Zero computers, this finding reports it as a path instead.

References

  1. Microsoft: Entra Connect accounts and permissionslearn.microsoft.com
  2. Microsoft: Harden your Entra Connect serverlearn.microsoft.com
  3. Microsoft: SCOM Active Directory integration for agent assignmentlearn.microsoft.com
  4. Misconfiguration Manager: SCCM attack and defense techniquesgithub.com
  5. Microsoft: Enterprise access modellearn.microsoft.com
  6. MITRE ATT&CK T1072: Software Deployment Toolsattack.mitre.org

Very new and undergoing testing. These features haven't received a lot of testing yet. Try them out and let us know what's working.

↑↓ to moveEnter to openEsc to close