ADDOM-003: Schema Version Identification
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla binds to the Schema naming context using the rootDSE schemaNamingContext attribute and reads the objectVersion integer attribute on the Schema container itself (for example CN=Schema,CN=Configuration,DC=contoso,DC=com). It also reads objectVersion on CN=<domain>,CN=Partitions,CN=Configuration (the domain functional preparation marker written by adprep /domainprep) and compares both against the published values for each Windows Server release. The check additionally retrieves msDS-Behavior-Version on the domain and forest NTDS Settings objects, which records domain and forest functional level. Together these four values (forest schema objectVersion, domain prep objectVersion, msDS-Behavior-Version on the domain, msDS-Behavior-Version on the forest) describe the actual capability surface of the directory. The check fails when the schema objectVersion is below the value associated with the current latest supported Windows Server release: 87 (Windows Server 2016), 88 (Windows Server 2019 and 2022, identical schema), or 90 (Windows Server 2025). A schema below 87 is treated as a hard fail because it indicates the forest has not been prepared for any currently supported server release.
Por qué importa
Schema version is not itself a vulnerability, but it is a strong proxy for two real risks. First, a forest stuck on an older schema cannot host modern security features. msDS-KeyCredentialLink (introduced with Windows Server 2016, objectVersion 87) is required for Windows Hello for Business public-key authentication and is also the attribute Shadow Credentials abuse targets; defenders cannot detect or remediate Shadow Credentials primitives that the directory does not store. Authentication Policies and Authentication Policy Silos, the supported mechanism for restricting where Tier 0 accounts can authenticate, require the Windows Server 2012 R2 schema (objectVersion 69). Claims, compound authentication, and Kerberos armoring require the same schema generation. Second, the schema version usually tracks domain controller OS version. A forest at schema 47 (Windows Server 2008 R2) is almost certainly running 2008 R2 or 2012 domain controllers, both end of support, missing every post-2014 KDC and SAM hardening change including the patches behind CVE-2020-1472 (Zerologon), CVE-2021-42287 / CVE-2021-42278 (sAMAccountName spoofing, noPac), CVE-2022-26923 (Certifried), and the LDAP signing / channel-binding defaults. The blast radius of an outdated schema is therefore the entire forest: every domain controller, every Kerberos exchange, every cross-domain trust.
Ruta de ataque
An attacker rarely exploits the schema version directly. Instead, the schema version is used during reconnaissance to prioritize targets and select techniques. Step 1: enumeration. Any authenticated principal can read objectVersion on the Schema NC head over LDAP (the Schema container grants Read to Authenticated Users by default). Tools such as PowerView Get-DomainObject -SearchBase "CN=Schema,..." -Properties objectVersion, ldapsearch -b "CN=Schema,CN=Configuration,DC=..." objectVersion, or ADExplorer return the value in a single round trip. Step 2: capability inference. The attacker maps objectVersion to the Windows Server generation. Schema 47 means 2008 R2 or 2012 DCs and immediate exposure to Zerologon (CVE-2020-1472), PrintNightmare (CVE-2021-34527), and unconstrained Kerberos delegation primitives that were tightened in later releases. Step 3: technique selection. Against a schema below 69, the attacker knows Authentication Policy Silos are not deployed, so Tier 0 accounts are reachable from member workstations and can be harvested via standard credential theft. Against a schema below 87, the attacker knows msDS-KeyCredentialLink is unlikely to be monitored and Shadow Credentials (Whisker, Certipy shadow) abuse against accounts with GenericWrite is unlikely to trigger alerts. Step 4: persistence. After compromise, the same recon attribute confirms whether modern object types exist (gMSAs, KDS root key, Protected Users group introduced with 2012 R2 schema 69). An attacker on a pre-69 schema knows Protected Users is not present, so harvested credentials are not subject to that grouping or the associated TGT lifetime restrictions. The attribute itself is not weaponized. It is a signal that drives the rest of the kill chain.
Cómo lo evalúa Guerrilla
The check issues a single anonymous-bindable LDAP query against the rootDSE to retrieve schemaNamingContext, defaultNamingContext, and configurationNamingContext. It then queries (objectClass=dMD) at the Schema NC head and reads objectVersion (integer). The same query path also retrieves fSMORoleOwner so the operator knows which DC currently holds the Schema Master role (CN=Schema,CN=Configuration,DC=<root>; fSMORoleOwner points to the NTDS Settings object of the holding DC). For domain prep state, Guerrilla reads objectVersion on CN=ActiveDirectoryUpdate,CN=DomainUpdates,CN=System,DC=<domain> (this is the per-domain prep marker incremented by adprep /domainprep). The check maps the integer values against the canonical table: 13 (Windows 2000), 30 (Windows Server 2003), 31 (Windows Server 2003 R2), 44 (Windows Server 2008), 47 (Windows Server 2008 R2), 56 (Windows Server 2012), 69 (Windows Server 2012 R2), 87 (Windows Server 2016), 88 (Windows Server 2019 and Windows Server 2022, identical schema), 90 (Windows Server 2025). The check emits the observed value, the mapped release, and the delta to the latest supported release. Because the read is on the Schema NC head and not on individual DC objects, no remoting or registry access is required.
Valor recomendado
Schema version corresponding to Windows Server 2022 (version 88) or later
Remediación
Run adprep /forestprep and adprep /domainprep from the latest Windows Server installation media to update the schema. Verify the objectVersion attribute on CN=Schema,CN=Configuration,DC=domain
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-6, CM-2
- CIS Benchmark
- 18.3.1
- CIS AD Benchmark
- 1.1.3
- MITRE ATT&CK
- T1078.002