PW-037HygieneKerberos, passwords and credentials

Seamless SSO Kerberos key not rolled over

The Seamless SSO account's Kerberos key is older than 30 days, and whoever has it can sign in to Entra ID as any synchronized user.

Category: Hygiene
Severity: Medium.
Typical owner: AD / identity team, with the Entra ID team
Data needed: Any collection: the AZUREADSSOACC account's password age, measured from the collection's time. The limit is 30 days by default and can be changed in the settings.

MITRE ATT&CKT1558.002

Most useful toIdentity and access engineers Defensive engineers

On this page

In plain language

Seamless Single Sign-On lets domain-joined computers sign in to Entra ID with Kerberos. To do that, the on-premises domain and Entra ID share one key: the password of the computer account AZUREADSSOACC.

Whoever has that key can forge a ticket for any synchronized user and sign in to Entra ID as them. The key never changes on its own, so a key stolen once keeps working until someone rolls it over. Microsoft recommends rolling it over at least every 30 days, which users don't notice.

What Pathwarden flags

The Seamless SSO computer account (AZUREADSSOACC) has a Kerberos key that was last changed more than 30 days ago (the Old Seamless SSO key field in Settings > Rules changes the limit). Entra ID shares that key with the on-premises domain to accept Kerberos tickets for Seamless Single Sign-On. Pathwarden reads the age from the account's pwdLastSet.

How attackers use it

Whoever has the key can forge a Kerberos service ticket for the account (a silver ticket) for any synchronized user, and sign in to Entra ID as that user. The key never changes on its own, so a key stolen once, through DCSync or a domain controller backup, keeps working until someone rolls it over. Microsoft recommends rolling it over at least every 30 days.

Find it with Pathwarden

Data needed: Any collection: the AZUREADSSOACC account's password age, measured from the collection's time. The limit is 30 days by default and can be changed in the settings.

In the web UI or the HTML report, open the Findings tab and expand PW-037: each finding shows who can use it (its exposure), the attack path drawn out, the affected objects, and the fix. The remediation path tells you whether a single plan step closes it. On the command line:

Shell

# every finding of this rule, with its path and fix
pathwarden findings -i .\collect --rule PW-037
# the step-by-step guide on this page, offline
pathwarden guide PW-037
# after the fix: collect again, then check it is gone
pathwarden retest -i .\collect-after --rule PW-037

Exit codes make retest easy to script: 0 Fixed, 1 Still open, 3 Can't tell. See findings lifecycle and retest.

Before you change anything

The rollover runs on the Entra Connect server, as a Hybrid Identity Administrator in Entra ID and a Domain Admin of each forest that has the account.
Kerberos tickets already issued for the account stay valid until they expire (10 hours by default). Users don't notice the rollover.

How to fix it

Option A: Roll the key over with Microsoft's module

On the Entra Connect server, open PowerShell in %ProgramFiles%\Microsoft Azure Active Directory Connect.
Import the AzureADSSO.psd1 module, sign in with New-AzureADSSOAuthenticationContext, and list the forests with Get-AzureADSSOStatus.
For each forest, run Update-AzureADSSOForest with the credentials of a Domain Admin of that forest.
Repeat at least every 30 days. A scheduled task with a dedicated account is common; that account is then Tier Zero.

Option B: Seamless SSO is no longer used

Turn Seamless SSO off in Entra Connect, and delete the AZUREADSSOACC computer account in each forest.

PowerShell

cd "$env:ProgramFiles\Microsoft Azure Active Directory Connect"
Import-Module .\AzureADSSO.psd1
New-AzureADSSOAuthenticationContext
Get-AzureADSSOStatus | ConvertFrom-Json
$creds = Get-Credential   # a Domain Admin of the forest, DOMAIN\user
Update-AzureADSSOForest -OnPremCredentials $creds

# The age, before and after
Get-ADComputer AZUREADSSOACC -Properties PasswordLastSet | Select-Object Name, PasswordLastSet

Verify the fix

Get-ADComputer AZUREADSSOACC -Properties PasswordLastSet shows today's date. Use Retest on the finding: it re-reads the account, and the finding is fixed.

Roll back

A rollover can't be undone, and doesn't need to be: Seamless SSO keeps working with the new key.

References

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-faqlearn.microsoft.com
Microsoft: Entra Connect accounts and permissionslearn.microsoft.com
https://aadinternals.com/aadinternals.com
MITRE ATT&CK T1558.002: Steal or Forge Kerberos Tickets: Silver Ticketattack.mitre.org