ADDOM-020: Configuración de la contraseña DSRM
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
La contraseña del Modo de restauración de servicios de directorio (DSRM) proporciona acceso de administrador local a un controlador de dominio cuando se arranca en modo de recuperación. Un atacante con acceso físico o remoto que conozca la contraseña DSRM puede extraer toda la base de datos de AD. La contraseña DSRM debe ser única por DC y rotarse con regularidad
Por qué importa
The DSRM account is a local administrator on the domain controller. It is stored in the registry SAM hive (not NTDS.dit) and is the recovery backstop when AD DS will not start. Microsoft introduced DsrmAdminLogonBehavior in Windows Server 2008 specifically because the DSRM hash is recoverable from any prior DC compromise: it sits in the SAM, it is rarely rotated, and on most networks the same string was typed into every DC promotion wizard. With DsrmAdminLogonBehavior = 2 the attacker can authenticate to a DC over SMB or RDP as a local administrator without ever needing a domain credential, then perform DCSync, dump LSASS, or push a backdoor service. With DsrmAdminLogonBehavior = 0 the same hash is essentially useless for remote access, the attacker would need physical or out-of-band console access and the ability to reboot the DC into DSRM mode. The misconfiguration also enables a persistence pattern: a previously-domain-admin attacker can extract the DSRM hash, lose all domain credentials in a password reset, and still return to the DC weeks later if DsrmAdminLogonBehavior was set to 2 during the original compromise.
Ruta de ataque
The attack chain starts with the attacker obtaining the DSRM password hash. Common sources are: an offline NTDS.dit and SYSTEM hive copy (the SYSTEM hive contains the boot key needed to decrypt SAM, and a backup operator with VSS rights can produce both), a memory dump of a domain controller (LSASS or the SAM cache), or simply a prior Domain Admin compromise where the attacker ran reg save HKLM\SAM. Mimikatz (lsadump::sam) and impacket secretsdump.py both surface the DSRM hash directly. With the hash in hand, the attacker checks DsrmAdminLogonBehavior. If set to 2, the attacker can pass-the-hash to the DC using the local Administrator account name and the DSRM NTLM hash (impacket psexec.py, wmiexec.py, smbexec.py, or Mimikatz sekurlsa::pth) and obtain local SYSTEM on the DC. From there, the attacker drops a service, registers a scheduled task as SYSTEM, runs Mimikatz lsadump::dcsync to extract the krbtgt hash and forge golden tickets, or installs a Skeleton Key. Because DSRM is a local SAM account, no domain authentication event is generated, the only artifact is a 4624 logon event with logon type 3 (network) showing the DSRM account name authenticating from the attacker host. Sean Metcalf publicly demonstrated this end-to-end persistence chain in 2015 and it remains a recurring finding in Mandiant incident response engagements.
Cómo lo evalúa Guerrilla
Guerrilla enumerates domain controllers via Get-ADDomainController -Filter * and connects to each over WinRM (or falls back to remote registry where allowed). On each DC, it reads HKLM\System\CurrentControlSet\Control\Lsa\DsrmAdminLogonBehavior and records the REG_DWORD value. The check then enumerates the System event log for source Directory-Services-SAM and event ID 16969 (DSRM password change events written when ntdsutil set dsrm password runs), extracts the most recent change time per DC, and computes the age in days. Where the auditor has read access, the cmdlet pulls the DSRM account hash via remote registry SAM enumeration and compares the hash digest across DCs to flag identical DSRM passwords reused across the fleet. Output includes per-DC values for DsrmAdminLogonBehavior, last DSRM password change date, password age in days, and a uniqueness flag.
Valor recomendado
Contraseña DSRM única por DC, rotada anualmente y almacenada de forma segura. DsrmAdminLogonBehavior establecido en 0 para impedir el inicio de sesión DSRM por red
Remediación
Restablezca las contraseñas DSRM con 'ntdsutil > set dsrm password' en cada DC. Establezca el valor de registro DsrmAdminLogonBehavior en 0 en HKLM\System\CurrentControlSet\Control\Lsa para impedir que la cuenta DSRM se use para el inicio de sesión por red. Documente y almacene las contraseñas de forma segura
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| degraded | WARN |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1), AC-6
- ANSSI
- R10
- CIS AD Benchmark
- 1.2.4
- MITRE ATT&CK
- T1003, T1078.002