ADDOM-001: Forest Functional Level
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla reads the msDS-Behavior-Version attribute on the rootDSE forest object (CN=Partitions,CN=Configuration,DC=...) and on the ForestRootDomain object. The integer value maps to a forest functional level: 0 = 2000, 2 = 2003, 3 = 2008, 4 = 2008 R2, 5 = 2012, 6 = 2012 R2, 7 = 2016. The check fails when msDS-Behavior-Version is less than 7. The cmdlet also returns the underlying Get-ADForest ForestMode string so the operator sees both the raw attribute and the friendly name.
Por qué importa
Functional level is more than a compatibility flag, it is the gate for several security features that defenders rely on. At FFL 2016 the forest gains Privileged Access Management (PAM), which is the prerequisite for shadow principals, expiring group memberships, and the bastion-forest model used in tiered administration designs. The 2016 KDC honors authentication policies and authentication policy silos enforced through claims, which lets an organization scope which hosts a Tier 0 account can sign in to. Older functional levels imply that DCs still run, or recently ran, Windows Server 2012 R2 or earlier, which means SMB1 may still be available on at least one DC, NTLMv1 acceptance is harder to remove cleanly, and the SAM remote protocol hardening (CVE-2022-37966 / CVE-2022-37967 family) cannot be applied with the same defaults. The blast radius is forest-wide: any domain in the forest inherits the ceiling.
Ruta de ataque
An attacker who reaches a foothold in an AD environment running at FFL 2012 R2 or lower benefits in several concrete ways. First, the absence of PAM means tier 0 groups have permanent membership, which makes a successful DCSync or Kerberoast attack permanently valuable rather than time-bound. Second, the inability to enforce authentication policy silos means a compromised Tier 0 credential can be replayed against any workstation in the forest, which is the standard pivot path documented by Sean Metcalf and the Mandiant red team. Third, legacy DCs that justified the older FFL frequently still accept RC4-HMAC for service tickets, opening the door to Kerberoasting (T1558.003) and AS-REP roasting (T1558.004) with cheap offline cracking. Tools: Rubeus for ticket extraction, Mimikatz lsadump::dcsync for replication abuse, and BloodHound for path discovery, all behave the same against any FFL but the defender loses the most effective mitigations at lower levels.
Cómo lo evalúa Guerrilla
The check binds anonymously or with a low-privilege account to the rootDSE, reads the forestFunctionality attribute (also exposed as a constructed attribute on rootDSE), then performs a second read of msDS-Behavior-Version on the CN=Partitions,CN=Configuration,DC=<forest> container to confirm. Guerrilla cross-references the value against the operating system of every domain controller (operatingSystemVersion on each DC computer object) to flag the common state where every DC already runs 2019 or 2022 but the FFL was never raised, which is the easiest remediation case.
Valor recomendado
Windows Server 2016 or higher
Remediación
Raise the forest functional level via Active Directory Domains and Trusts > Right-click the forest root > Raise Forest Functional Level. Ensure all domain controllers run a supported OS version before raising
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-6, SI-2
- CIS Benchmark
- 18.3.1
- ANSSI
- R1
- CIS AD Benchmark
- 1.1.1
- MITRE ATT&CK
- T1078.002