ADPRIV-026: Privileged Users Local Logon on DCs
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
For each domain controller the check resolves the effective set of principals granted the following user rights, which together control interactive access to the box: - SeInteractiveLogonRight (Allow log on locally) - SeRemoteInteractiveLogonRight (Allow log on through Remote Desktop Services) - SeDenyInteractiveLogonRight (Deny log on locally) - SeDenyRemoteInteractiveLogonRight (Deny log on through Remote Desktop Services) - SeBatchLogonRight and SeServiceLogonRight, because batch and service logons on a DC also expose credentials to lsass. The effective assignment is computed by reading the Default Domain Controllers Policy (GUID {6AC1786C-016F-11D2-945F-00C04fB984F9}) and any additional GPOs linked to the Domain Controllers OU (or to the domain root and inherited), then merging the per-DC local security database (secedit /export, or the corresponding LSA policy via LsaEnumerateAccountsWithUserRight). Each principal in the merged set is resolved by SID and classified against the documented Tier-0 boundary: BUILTIN\Administrators, Domain Admins (RID 512), Enterprise Admins (RID 519), the DC machine accounts themselves, and any explicitly authorized Tier-0 service principal. Any SID that resolves to a regular user, a server operator, a backup operator outside Tier-0, a helpdesk group, a workstation admin group, Authenticated Users, INTERACTIVE, or Everyone is reported. The check additionally inspects the Default Domain Controllers Policy GptTmpl.inf under \\<domain>\SYSVOL\<domain>\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf to detect explicit Tattoo settings, and compares the GPO version stamp against the per-DC tattooed value so that a DC which has stopped applying the policy (broken SYSVOL replication, disabled gpsvc, blocked inheritance) is flagged.
Por qué importa
Every interactive logon on a Windows host writes the authenticating principal credentials into LSASS memory. On a domain controller this is unavoidable for the legitimate Tier-0 administrator, but every additional principal granted interactive or RDP logon multiplies the exposure surface: the credentials of a helpdesk technician logging on to triage a DC, a monitoring service account running interactively, or a server operator restarting a service all reside in LSASS for the duration of the session and, depending on logon type and protocol, persist as cached Kerberos tickets, NT hashes, and (on older configurations) cleartext credentials. A workstation compromise on the source endpoint of the RDP session lets an attacker collect those credentials via Mimikatz sekurlsa::logonpasswords, a keylogger on the RDP client, or RDP session hijacking via tscon.exe, and then re-use them directly on the DC. Because the principal already has SeInteractiveLogonRight on the DC, no privilege escalation is required: the attacker simply re-authenticates and is on the DC. The blast radius is the entire forest. Once an attacker has any interactive session on a DC they can run lsass dumping, extract krbtgt for Golden Tickets, run ntdsutil ifm to capture NTDS.dit, install a DSRM backdoor, replace ntdsai.dll with a malicious skeleton-key DLL, modify the Default Domain Controllers GPO to plant a persistent SYSTEM scheduled task, or simply add their own account to Enterprise Admins. MITRE ATT&CK tracks this category as T1078.002 (Valid Accounts: Domain Accounts) and the credential acquisition step as T1003.001 (OS Credential Dumping: LSASS Memory) and T1003.003 (NTDS). Microsoft has documented the Tier-0 logon restriction as a hard requirement of the Enterprise Access Model since 2014, and the Securing Privileged Access roadmap calls the cleanup of DC logon rights one of the first 30-day actions in a hardening program.
Ruta de ataque
1. Reconnaissance: from any authenticated user context the attacker enumerates the Default Domain Controllers Policy and, where readable, the merged GptTmpl.inf to discover which principals hold SeInteractiveLogonRight on DCs. Tools such as PowerView (Get-DomainGPOUserLocalGroupMapping), BloodHound (CanRDP and CanLogOn edges), and Grouper2 parse SYSVOL GPO templates directly. Authenticated Users can read SYSVOL by default, so this step requires no special rights. 2. Targeting: the attacker identifies a non-Tier-0 principal (for example a Server Operators member, a helpdesk group, a monitoring service account, or a workstation administrator) that is listed in the DC logon-rights set. BloodHound expresses this as a CanRDP edge from the principal to a DC computer object. 3. Initial foothold: the attacker compromises an endpoint where any member of that principal authenticates. Common vectors include phishing the helpdesk account, exploiting an unpatched workstation (Print Spooler, MSDT), or pivoting from a less-protected server. The attacker now has SYSTEM on the source endpoint. 4. Credential acquisition on the source: when the legitimate user RDPs from the source endpoint to a DC, the attacker captures credentials in transit. Options include Mimikatz sekurlsa::logonpasswords against the source LSASS to recover the helpdesk NT hash, RDP session hijacking via tscon.exe to assume the live RDP session into the DC without re-authentication, or keylogging the mstsc.exe credential prompt. 5. Direct interactive access on the DC: with the captured credentials (or the hijacked RDP session), the attacker connects to the DC via mstsc.exe or via a network logon followed by PsExec. The DC accepts the logon because the principal holds SeRemoteInteractiveLogonRight. 6. Tier-0 actions on the DC: with an interactive session on a DC the attacker runs sekurlsa::logonpasswords to harvest credentials of any other interactive session on the DC, runs lsadump::dcsync /user:krbtgt to extract the krbtgt hash, runs ntdsutil "activate instance ntds" "ifm" "create full c:\temp" to dump NTDS.dit, or modifies the Default Domain Controllers Policy to add a SYSTEM scheduled task as persistence. 7. Forest-wide persistence: with krbtgt the attacker forges Golden Tickets and survives all password resets short of a double krbtgt rotation. With NTDS.dit the attacker has every account hash in the forest for offline cracking and pass-the-hash. With write access to the Default Domain Controllers Policy the attacker has SYSTEM on every DC on every gpupdate cycle.
Cómo lo evalúa Guerrilla
Guerrilla resolves DC logon rights using two parallel paths and reconciles the results. First, it enumerates the Default Domain Controllers Policy and every additional GPO linked to the Domain Controllers OU (Get-GPInheritance -Target "OU=Domain Controllers,DC=<domain>") and parses the MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf for each in SYSVOL, extracting the [Privilege Rights] section keys SeInteractiveLogonRight, SeRemoteInteractiveLogonRight, SeDenyInteractiveLogonRight, SeDenyRemoteInteractiveLogonRight, SeBatchLogonRight, and SeServiceLogonRight. Second, for each domain controller in Get-ADDomainController -Filter * the check invokes the LSA policy API (LsaOpenPolicy + LsaEnumerateAccountsWithUserRight) over a remote RPC connection to retrieve the effective per-DC assignment as actually applied. Discrepancies between the policy-declared set and the per-DC effective set are reported as a secondary finding (broken GPO application). Each SID in the merged set is resolved through Get-ADObject and classified against the canonical Tier-0 boundary. The well-known SIDs S-1-5-32-544 (BUILTIN\Administrators), S-1-5-21-<domain>-512 (Domain Admins), S-1-5-21-<root>-519 (Enterprise Admins), and the per-DC machine SIDs are accepted. Anything else (S-1-1-0 Everyone, S-1-5-11 Authenticated Users, S-1-5-4 INTERACTIVE, BUILTIN\Server Operators S-1-5-32-549, BUILTIN\Backup Operators S-1-5-32-551 when not pre-approved as Tier-0, BUILTIN\Print Operators S-1-5-32-550, any custom group, or any individual user) is reported with the resolved DN, the originating GPO, the right held, and a recommended deny entry. The check also samples Windows Security Event ID 4624 (Logon) on each DC with LogonType 2 (Interactive) and LogonType 10 (RemoteInteractive) from the prior 30 days, and reports any actual interactive logon by a non-Tier-0 principal. This second-pass evidence often surfaces operationally-required exceptions (a backup agent, a monitoring console) that the static policy review alone would miss.
Valor recomendado
Only Domain Admins and designated Tier 0 accounts allowed local logon on DCs. 'Allow log on locally' restricted via GPO on Domain Controllers OU
Remediación
Configure via Group Policy applied to Domain Controllers OU: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment > 'Allow log on locally' = Administrators, Domain Admins only. Remove all other entries and test thoroughly
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1), AC-3
- CIS Benchmark
- 2.2.7
- ANSSI
- R7
- CIS AD Benchmark
- 4.10.1
- MITRE ATT&CK
- T1078.002, T1003