Home > Risks

Active Directory Security Risks

To adequately protect an Active Directory deployment, one must also understand the risks that Active Directory is exposed to. This is the second step, because to protect any system, one must know what risks it needs to be protected against.

Every Active Directory deployment is fundamentally exposed to the following risks -

Compromise of a Domain Controller - The compromise of a even a single Domain Controller (DC) or Secure Administrative Workstation (SAW) in an Active Directory forest is tantamount to a complete compromise of an Active Directory forest.

Note - In addition to risks that DCs are exposed to as computers operating on Windows, the domain computer accounts of all DCs and all domain-joined SAWs are stored in Active Directory, as Active Directory contents, and are thus exposed to risks III.1, III.2, III.3. III.6, III.7, III.8 and III.11 below .

Compromise of a System Administrator - The compromise of a even a single account or group that has administrative access in/over Active Directory is tantamount to a complete compromise of an Active Directory forest.

Note - Except for the DS Restore Mode Administrator account, all Active Directory administrative accounts and groups are stored in Active Directory, as Active Directory contents, and are thus exposed to risks III.1, III.2, III.3, III.4. III.5, III.6, III.7, III.8 and III.11 below .

Compromise of Active Directory Contents - The contents of Active Directory are exposed to the risk of unauthorized modification and the impact of compromise of Active Directory contents is a function of the nature of the content compromised -
1. The compromise of the domain root object could provide the perpetrator access to the entire contents of Active Directory, as well as the credentials of all accounts, and be tantamount to a complete compromise of an Active Directory forest.
2. The compromise of the AdminSDHolder object will provide the perpetrator unrestricted administrative access to the entire contents of the Active Directory forest, and is tantamount to a complete compromise of an Active Directory forest.
3. The compromise of an organizational unit (OU) (object) could provide the perpetrator access to the entire* contents of the OU, including the ability to unleash malware (e.g. ransomware) on all computers whose accounts reside in the OU.
4. The compromise of a container (object) could provide the perpetrator access to the entire* contents of the container, including the ability to compromise all domain accounts and security groups stored in the container.
5. The compromise of a domain user account (object) will provide the perpetrator access to all IT assets/resources that that domain user account has access to in the network, and beyond.
  
  Note - The compromise of even one domain user account that is administrative in nature i.e. a Domain Admin equivalent account (e.g. CN=Administrator,CN=Users,DC=... (S-1-5-{domain}-500)) is tantamount to a complete compromise of an Active Directory forest.
6. The compromise of a domain computer account (object) will provide the perpetrator access to everything stored on that domain computer account and everything that computer account has access to in the network, and beyond.
  
  Note - The compromise of even one domain controller's computer account (e.g. CN=DC1,OU=Domain Controllers,DC=...) or a domain computer account for a SAW is tantamount to a complete compromise of an Active Directory forest.
7. The compromise of a standalone managed, group managed or delegated managed service account (object) will provide the perpetrator access to everything that service account has access to in the network, and beyond.
  
  Note - The compromise of even one service account that has Domain Admin equivalent administrative access in Active Directory is tantamount to a complete compromise of an Active Directory forest.
8. The compromise of a domain security group (object) will provide the perpetrator access to all IT assets/resources that that domain security group has access to in the network, and beyond.
  
  Note - The compromise of even one domain security group that is administrative in nature (e.g. Builtin Administrators (S-1-5-32-544), Domain Admins (S-1-5-21-{domain}-512), Enterprise Admins (S-1-5-21-{root-domain}-519) etc.) is tantamount to a complete Active Directory compromise.
9. The compromise of a service connection point (SCP) (object) will provide the perpetrator the ability to disrupt the service that relies on that SCP for locating instances of that service.
10. The unauthorized modification of an object of class trustedDomain (TDO) could be used to alter the nature of a trust relationship in Active Directory.
11. The compromise of an object in the Schema partition could result in a security breach, and depending on the nature of modification, possibly be tantamount to a complete compromise of an Active Directory forest.
  
  Note - An unauthorized modification of the defaultSecurityDescriptor attribute of a Class Schema object could be used to gain administrative access over all new instances of that Class, and depending on the scenario, this could be tantamount to a complete Active Directory compromise.
12. The compromise of an object in the Configuration partition could be used to launch various attacks, including a denial of service attack on Active Directory, and possibly be tantamount to a complete compromise of an Active Directory forest.
  
  Note - In addition, in an AD DS that relies on AD CS for enhanced client authentication, the unauthorized modification of various AD CS objects could result in perpetrators being able to enact various credential theft attacks, which could result in a complete Active Directory compromise.
13. The unauthorized creation of Active Directory objects could be used to create domain user accounts, domain computer accounts, domain security groups, OUs etc. which could then be used to fulfill or aid various malicious objectives.
14. The unauthorized deletion of Active Directory objects could be used to delete existing domain user accounts, domain computer accounts, domain security groups, OUs etc. which could result in denial-of-service and unauthorized access.

Compromise of an Active Directory Backup - The compromise of a even a single Active Directory backup must be considered tantamount to a complete compromise of an Active Directory forest.

Exploitation of a weakness in Active Directory's Logical Structure - The exploitation of any weakness in Active Directory's logical structure could result in the compromise of the entire Active Directory forest.

Note - An Active Directory's logical structure is primarily comprised of trust relationships, and each trust relationship is represented and stored in Active Directory domain partitions as a trustedDomain object (TDO) and is thus exposed to risks III.1, III.4 and III.10 above .

Compromise of Critical Dependencies -