ADTIER-004: Configuration Management Service Accounts in Privileged Groups
- Platform
- Active Directory
- Category
- Tier-0 Hygiene & Hybrid Identity Surface
- Severity
- Critical
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The check builds a candidate set of configuration-management service principals using two passes: 1. Pattern match on sAMAccountName, description, servicePrincipalName, and userPrincipalName for substrings associated with the supported products: sccm, mecm, cm_, smsadmin, naaaccount, na_, intuneconnector, aadconnect_, jamf, kace, lansweeper, manageengine, desktopcentral, ivanti, landesk, bigfix, besadmin, tanium, pdqdeploy, ninjaone, automox, baramundi, matrix42, snow. 2. SPN match on registered service classes that are unique to those products, including the SMS_SITE_SYSTEM, SMS_SQL_SERVER, MP_, DP_, and MECM-published SPNs, plus generic MSSQLSvc SPNs on hosts whose dNSHostName resolves to a known site server. For each candidate principal the check resolves recursive membership of the Tier-0 groups by well-known SID: - Domain Admins (S-1-5-21-<domain>-512) - Enterprise Admins (S-1-5-21-<root domain>-519) - Schema Admins (S-1-5-21-<root domain>-518) - Administrators (S-1-5-32-544) - Account Operators (S-1-5-32-548) - Backup Operators (S-1-5-32-551) - Server Operators (S-1-5-32-549) - Print Operators (S-1-5-32-550) - DnsAdmins (resolved by name within each domain) The check also inspects the SCCM Network Access Account where it can be identified (sAMAccountName containing naa, NetworkAccessAccount, or referenced by the SMS Provider SPN owner), because the NAA password is recoverable from any managed client and a privileged NAA equals an immediate domain compromise. Finally it reports any computer object representing a site server, management point, or distribution point that is itself a member of a Tier-0 group, since the site-server machine account holds equivalent rights to the service identity in modern SCCM deployments.
Why it matters
Configuration-management products are not ordinary applications. By design they execute code as SYSTEM on every managed endpoint, hold credentials that authenticate to every managed endpoint, and store policy that any client can request. That property makes them an out-of-band Tier-0 system regardless of where they sit on the org chart. SCCM in particular has a documented chain of abuse primitives, each of which has been weaponised in public tooling (SharpSCCM, CMLoot, Misconfiguration Manager): the Network Access Account password is encrypted with a key derivable by any authenticated client and can be recovered with a single WMI query; the site server can be coerced to authenticate to an attacker-controlled relay over NTLM via PrinterBug, PetitPotam, or DFSCoerce, and that authentication can be relayed to LDAP or AD CS for elevation; client-push installation uses the configured push account against any host the attacker can add to the site database; and the SCCM site database holds the BitLocker recovery keys, OS deployment task sequence variables, and application install scripts for the entire estate. If the service account or the site server machine account is a Domain Admin, every one of those primitives becomes a one-step path from a managed workstation to krbtgt. The same logic applies to Intune Connector for AD (it holds the credential used to join Autopilot devices to the on-premises domain), Jamf binding accounts, KACE and Lansweeper inventory accounts, and BigFix relay service accounts.
Attack path
1. Foothold on any managed client. The attacker phishes, exploits, or buys access to a workstation enrolled in the configuration-management estate. 2. NAA disclosure (SCCM). The attacker queries the local WMI namespace root\ccm\policy\Machine\ActualConfig for CCM_NetworkAccessAccount instances, then decrypts the NetworkAccessUsername and NetworkAccessPassword with the DPAPI master key available to SYSTEM. Tools: SharpSCCM get secrets, CMLoot, MalSCCM. If the NAA is a Domain Admin, the attacker now holds DA credentials. 3. NTLM coercion to site server. The attacker triggers the site server, the SMS Provider, or a management-point machine account to authenticate to an attacker-controlled relay. Coercion primitives: PrinterBug (MS-RPRN), PetitPotam (MS-EFSR), DFSCoerce (MS-DFSNM), ShadowCoerce (MS-FSRVP). The relayed authentication is forwarded to LDAP, ADCS HTTP, or SMB. If the site server machine account is a Domain Admin, the relayed authentication yields direct DA-equivalent access. 4. Site takeover via SMS Provider. With local admin on the site server (often inherited because the service account is a DA, or because the site server machine account is a DA and was relayed), the attacker becomes a Full Administrator inside SCCM, then deploys an arbitrary application or task sequence to any device collection. This includes targeting Domain Controllers if they happen to be managed by the same site, which is common. 5. Client push abuse. The attacker adds a controlled host to the site database, triggers client push installation, and harvests the push installation account credential from the resulting authentication. If client push is configured with a Domain Admin, every push installation leaks that credential to whichever host the attacker chose. 6. Lateral movement to every managed endpoint. With SCCM Full Administrator (or equivalent in the other products) the attacker deploys a malicious application or script to a collection containing the entire estate, achieving SYSTEM execution everywhere in minutes. This is the path taken by multiple ransomware crews that abuse SCCM as a distribution backbone for the encryptor.
How Guerrilla assesses it
Guerrilla performs the candidate-account discovery entirely over LDAP so the check works against any reachable DC without RSAT or the ConfigurationManager PowerShell module loaded locally. For each domain it binds to a writable DC, resolves the well-known Tier-0 SIDs, and reads the member attribute of each Tier-0 group with range-retrieval to handle membership counts above the LDAP page size. Recursive expansion is performed in PowerShell so nested groups, foreign-security-principals from forest trusts, and tombstoned references are surfaced rather than silently dropped. The candidate set is then computed with two parallel LDAP filters: a sAMAccountName / description / userPrincipalName substring match across the supported product list, and an SPN match against the known SCCM and MECM SPN classes (SMS_SITE_SYSTEM, SMS_SQL_SERVER, MP_, DP_) plus MSSQLSvc SPNs whose hostname matches a discovered site system. Site systems themselves are discovered by searching the System Management container (CN=System Management,CN=System,DC=...) for objects of class mSSMSManagementPoint, mSSMSServerLocatorPoint, and mSSMSSite. Every match is intersected with the Tier-0 membership set, and the resulting findings are emitted with the principal DN, the matched product signature, the Tier-0 group reached, and the path used to reach it (direct membership, nested group chain, or computer-object membership for site-server machine accounts).
Recommended value
Config-management service accounts are scoped to their documented minimum rights and never in Domain Admins / Enterprise Admins. SCCM Network Access Account is a non-privileged dedicated identity.
Remediation
Identify the config-mgmt product and review service account rights. For SCCM: ensure the Network Access Account is non-privileged (NOT a Domain Admin); ensure the site server's machine account is not a Domain Admin; review hierarchy service accounts for least privilege. Move site servers and management points to a Tier-0 OU with restricted logons.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6
- CIS AD Benchmark
- 8.2.3
- MITRE ATT&CK
- T1072, T1078.002