ADPRIV-026: Inicio de sesión local de usuarios privilegiados en DC
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Solo las cuentas administrativas de Tier Zero designadas deben tener permitido iniciar sesión localmente en los controladores de dominio. Permitir que cuentas que no sean de Tier Zero inicien sesión en los controladores de dominio expone las credenciales privilegiadas a ataques de recolección de credenciales en estaciones de trabajo menos protegidas
Por qué importa
Every interactive logon on a Windows host writes the authenticating principal credentials into LSASS memory. On a domain controller this is unavoidable for the legitimate Tier-0 administrator, but every additional principal granted interactive or RDP logon multiplies the exposure surface: the credentials of a helpdesk technician logging on to triage a DC, a monitoring service account running interactively, or a server operator restarting a service all reside in LSASS for the duration of the session and, depending on logon type and protocol, persist as cached Kerberos tickets, NT hashes, and (on older configurations) cleartext credentials. A workstation compromise on the source endpoint of the RDP session lets an attacker collect those credentials via Mimikatz sekurlsa::logonpasswords, a keylogger on the RDP client, or RDP session hijacking via tscon.exe, and then re-use them directly on the DC. Because the principal already has SeInteractiveLogonRight on the DC, no privilege escalation is required: the attacker simply re-authenticates and is on the DC. The blast radius is the entire forest. Once an attacker has any interactive session on a DC they can run lsass dumping, extract krbtgt for Golden Tickets, run ntdsutil ifm to capture NTDS.dit, install a DSRM backdoor, replace ntdsai.dll with a malicious skeleton-key DLL, modify the Default Domain Controllers GPO to plant a persistent SYSTEM scheduled task, or simply add their own account to Enterprise Admins. MITRE ATT&CK tracks this category as T1078.002 (Valid Accounts: Domain Accounts) and the credential acquisition step as T1003.001 (OS Credential Dumping: LSASS Memory) and T1003.003 (NTDS). Microsoft has documented the Tier-0 logon restriction as a hard requirement of the Enterprise Access Model since 2014, and the Securing Privileged Access roadmap calls the cleanup of DC logon rights one of the first 30-day actions in a hardening program.
Ruta de ataque
1. Reconnaissance: from any authenticated user context the attacker enumerates the Default Domain Controllers Policy and, where readable, the merged GptTmpl.inf to discover which principals hold SeInteractiveLogonRight on DCs. Tools such as PowerView (Get-DomainGPOUserLocalGroupMapping), BloodHound (CanRDP and CanLogOn edges), and Grouper2 parse SYSVOL GPO templates directly. Authenticated Users can read SYSVOL by default, so this step requires no special rights. 2. Targeting: the attacker identifies a non-Tier-0 principal (for example a Server Operators member, a helpdesk group, a monitoring service account, or a workstation administrator) that is listed in the DC logon-rights set. BloodHound expresses this as a CanRDP edge from the principal to a DC computer object. 3. Initial foothold: the attacker compromises an endpoint where any member of that principal authenticates. Common vectors include phishing the helpdesk account, exploiting an unpatched workstation (Print Spooler, MSDT), or pivoting from a less-protected server. The attacker now has SYSTEM on the source endpoint. 4. Credential acquisition on the source: when the legitimate user RDPs from the source endpoint to a DC, the attacker captures credentials in transit. Options include Mimikatz sekurlsa::logonpasswords against the source LSASS to recover the helpdesk NT hash, RDP session hijacking via tscon.exe to assume the live RDP session into the DC without re-authentication, or keylogging the mstsc.exe credential prompt. 5. Direct interactive access on the DC: with the captured credentials (or the hijacked RDP session), the attacker connects to the DC via mstsc.exe or via a network logon followed by PsExec. The DC accepts the logon because the principal holds SeRemoteInteractiveLogonRight. 6. Tier-0 actions on the DC: with an interactive session on a DC the attacker runs sekurlsa::logonpasswords to harvest credentials of any other interactive session on the DC, runs lsadump::dcsync /user:krbtgt to extract the krbtgt hash, runs ntdsutil "activate instance ntds" "ifm" "create full c:\temp" to dump NTDS.dit, or modifies the Default Domain Controllers Policy to add a SYSTEM scheduled task as persistence. 7. Forest-wide persistence: with krbtgt the attacker forges Golden Tickets and survives all password resets short of a double krbtgt rotation. With NTDS.dit the attacker has every account hash in the forest for offline cracking and pass-the-hash. With write access to the Default Domain Controllers Policy the attacker has SYSTEM on every DC on every gpupdate cycle.
Cómo lo evalúa Guerrilla
Guerrilla resolves DC logon rights using two parallel paths and reconciles the results. First, it enumerates the Default Domain Controllers Policy and every additional GPO linked to the Domain Controllers OU (Get-GPInheritance -Target "OU=Domain Controllers,DC=<domain>") and parses the MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf for each in SYSVOL, extracting the [Privilege Rights] section keys SeInteractiveLogonRight, SeRemoteInteractiveLogonRight, SeDenyInteractiveLogonRight, SeDenyRemoteInteractiveLogonRight, SeBatchLogonRight, and SeServiceLogonRight. Second, for each domain controller in Get-ADDomainController -Filter * the check invokes the LSA policy API (LsaOpenPolicy + LsaEnumerateAccountsWithUserRight) over a remote RPC connection to retrieve the effective per-DC assignment as actually applied. Discrepancies between the policy-declared set and the per-DC effective set are reported as a secondary finding (broken GPO application). Each SID in the merged set is resolved through Get-ADObject and classified against the canonical Tier-0 boundary. The well-known SIDs S-1-5-32-544 (BUILTIN\Administrators), S-1-5-21-<domain>-512 (Domain Admins), S-1-5-21-<root>-519 (Enterprise Admins), and the per-DC machine SIDs are accepted. Anything else (S-1-1-0 Everyone, S-1-5-11 Authenticated Users, S-1-5-4 INTERACTIVE, BUILTIN\Server Operators S-1-5-32-549, BUILTIN\Backup Operators S-1-5-32-551 when not pre-approved as Tier-0, BUILTIN\Print Operators S-1-5-32-550, any custom group, or any individual user) is reported with the resolved DN, the originating GPO, the right held, and a recommended deny entry. The check also samples Windows Security Event ID 4624 (Logon) on each DC with LogonType 2 (Interactive) and LogonType 10 (RemoteInteractive) from the prior 30 days, and reports any actual interactive logon by a non-Tier-0 principal. This second-pass evidence often surfaces operationally-required exceptions (a backup agent, a monitoring console) that the static policy review alone would miss.
Valor recomendado
Solo Domain Admins y las cuentas de Tier Zero designadas tienen permitido el inicio de sesión local en los controladores de dominio. 'Permitir el inicio de sesión local' restringido mediante GPO en la OU de Domain Controllers
Remediación
Configure mediante directiva de grupo aplicada a la OU de Domain Controllers: Configuración del equipo > Directivas > Configuración de Windows > Configuración de seguridad > Directivas locales > Asignación de derechos de usuario > 'Permitir el inicio de sesión local' = solo Administradores, Domain Admins. Elimine todas las demás entradas y pruebe exhaustivamente
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1), AC-3
- CIS Benchmark
- 2.2.7
- ANSSI
- R7
- CIS AD Benchmark
- 4.10.1
- MITRE ATT&CK
- T1078.002, T1003