ADDOM-008: Tombstone Lifetime Configuration
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla reads the tombstoneLifetime attribute on CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=<forest>. The attribute is forest-wide and stored in the Configuration partition, so the value is identical for every domain and every DC in the forest. The check fails when the attribute is unset (which causes Windows to fall back to the 60 day default), when the value is less than 180, or when the value exceeds 720 days. The cmdlet also reads msDS-DeletedObjectLifetime on the same object to detect the case where AD Recycle Bin is enabled but the deleted-object retention window has been left at its default of 180 days while TSL was raised, which is a common drift state after AD Recycle Bin is turned on.
Por qué importa
The tombstone lifetime is both a recovery primitive and an operational guardrail. If a DC is taken offline for longer than the TSL and then brought back, the surviving DCs will already have garbage collected objects that the returning DC still believes exist, producing lingering objects: deleted objects that the stale DC tries to outbound replicate back into the forest. Lingering objects can revive deleted users (including disabled or terminated accounts), revive deleted group memberships, and in worst cases revive a deleted Domain Admin. A TSL set too low (60 days) gives operators a very short window to detect a failed DC, which matters in branch office and DR scenarios. A TSL set too high (multi-year) keeps every deleted object in the directory database for years, which inflates ntds.dit size, slows defragmentation and authoritative restores, and gives an attacker who lands on a DC a long historical view of every account that has been deprovisioned. The check is paired with AD Recycle Bin because msDS-DeletedObjectLifetime defaults to the TSL value when AD Recycle Bin is first enabled, so changing TSL after the fact does not retroactively change the recycle bin window.
Ruta de ataque
Tombstone lifetime is not exploited in the same direct way as a permission misconfiguration; it is a force multiplier for two adversary techniques. First, if an attacker can take a single DC offline and hold it offline past the TSL (a destructive scenario aligned with T1485 Data Destruction or T1490 Inhibit System Recovery), the defender loses the ability to safely reintroduce that DC, forcing a metadata cleanup and rebuild and increasing recovery cost. Second, an attacker with read access to deleted objects (or with DCSync on the forest root) gains a longer historical census of every account ever created when TSL is set to multi-year values: service accounts that were rotated, contractors that were offboarded, and former administrators whose password hashes may still be reused in adjacent systems. Tools such as Mimikatz lsadump::dcsync and impacket secretsdump.py will return deleted-object data when bound with appropriate rights, and longer TSL windows give attackers a deeper history to mine. Finally, a misaligned TSL across a forest restore (where the restored copy has a different TSL than the surviving DCs) is a documented path to reanimating deleted privileged groups, which Microsoft calls out in the AD Forest Recovery Guide.
Cómo lo evalúa Guerrilla
The check performs an authenticated LDAP read of the tombstoneLifetime integer attribute on CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=<forest>. If the attribute is not present, Windows treats the value as 60 days (the legacy default), and Guerrilla flags this state explicitly so operators understand that "no value" does not mean "Microsoft default of 180." The cmdlet also reads msDS-DeletedObjectLifetime on the same DN, and the optional-feature enablement of the Recycle Bin Feature (CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration) to provide a complete recovery posture in the output. No event log read is required because the attribute is fully exposed over LDAP.
Valor recomendado
180 days
Remediación
Modify the tombstoneLifetime attribute on CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=domain. Set to 180 using ADSIEdit or PowerShell. Ensure AD Recycle Bin is enabled before modifying
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CP-9, CP-10
- CIS AD Benchmark
- 1.4.1
- MITRE ATT&CK
- T1485