ADPWD-003: FGPP Application Analysis
- Plataforma
- Active Directory
- Categoría
- AD Password & Lockout Policies
- Severidad
- Medium
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check binds to the Password Settings Container (CN=Password Settings Container,CN=System,DC=<domain>) and enumerates every msDS-PasswordSettings object. For each PSO it reads the policy attributes msDS-PasswordSettingsPrecedence, msDS-MinimumPasswordLength, msDS-MinimumPasswordAge, msDS-MaximumPasswordAge, msDS-PasswordHistoryLength, msDS-PasswordComplexityEnabled, msDS-PasswordReversibleEncryptionEnabled, msDS-LockoutThreshold, msDS-LockoutDuration, msDS-LockoutObservationWindow, and the multi-valued msDS-PSOAppliesTo attribute. The applies-to set is expanded recursively (group membership is followed transitively because the PSO Resultant Set only walks direct membership, but operators usually treat nested groups as in scope for inventory). Each privileged group is then inspected for members not covered by any PSO, or covered only by a PSO with weaker settings than the recommended baseline (typically: length >= 16 for privileged accounts, complexity enabled, reversible encryption disabled, history >= 24, lockout threshold between 5 and 10). The check also flags PSOs whose msDS-PSOAppliesTo is empty (orphaned policies that consume precedence numbers but apply to nothing) and PSOs that apply to dynamic or distribution groups (PSOs only honor global security groups and individual users).
Por qué importa
FGPPs were introduced in Windows Server 2008 to allow stronger password requirements for privileged accounts and service accounts without raising the floor for the entire domain. The mechanism is opt-in: an account that is not directly assigned a PSO, and is not a member of a global security group assigned a PSO, falls back to the Default Domain Policy (often 7-character or 8-character minimum, complexity sometimes disabled in legacy domains). When a Domain Admin or Tier 0 service account is left on the default policy, the attacker only needs to crack one 8-character NTLM hash to obtain forest dominance, a workload that is well under one hour on a single modern GPU rig. The misconfiguration also creates audit findings under PCI DSS 8.3, NIST SP 800-53 IA-5(1), and CIS Microsoft Active Directory Benchmark 5.1.3, all of which require demonstrably stronger controls on privileged identities. Real-world incident response cases consistently show that FGPPs are either absent, applied only to a "ServiceAccounts" group that has long since drifted out of date, or applied with a precedence higher than a weaker legacy PSO that wins the resultant-set evaluation.
Ruta de ataque
Step 1: Enumeration. With any authenticated user the attacker queries the Password Settings Container (LDAP filter (objectClass=msDS-PasswordSettings)). All authenticated users can read PSO metadata by default unless the DACL on the container has been hardened. The attacker records each PSO precedence, settings, and applies-to set. Step 2: Gap analysis. The attacker enumerates privileged groups (Get-ADGroupMember -Recursive on Domain Admins, Enterprise Admins, Administrators, the protected groups under AdminSDHolder) and identifies members whose msDS-ResultantPSO is null or points to the Default Domain Policy. Step 3: Target selection. The attacker picks a Domain Admin or kerberoastable service account whose effective policy permits short or non-complex passwords. Service accounts with SPNs are particularly valuable because the attacker can request a service ticket and crack the RC4 or AES hash offline. Step 4: Credential acquisition. For kerberoastable targets the attacker runs Rubeus kerberoast /user:svc_target or GetUserSPNs.py. For interactive accounts the attacker can attempt password spraying (T1110.003) against the weaker policy threshold without triggering lockout, or run an offline crack against a captured NTDS.dit extract. Step 5: Cracking. Hashcat -m 13100 (Kerberos 5 TGS-REP etype 23) or -m 1000 (NTLM) against the captured material. An 8-character password with mixed case and digits falls in hours; without complexity it falls in minutes. Step 6: Privilege use. The cracked credential is used directly (interactive logon, RDP, WinRM) or to forge a TGT (S4U2Self for protocol transition, or to request additional service tickets). Tier 0 reach is achieved without ever touching a DC interactively, leaving minimal forensic trail.
Cómo lo evalúa Guerrilla
Guerrilla binds anonymously or as the current user to the default naming context and reads CN=Password Settings Container,CN=System,DC=<domain>. The check enumerates every child object of class msDS-PasswordSettings and pulls the full PSO attribute set in one paged LDAP query. For each privileged group (built from a curated list plus any group with adminCount=1) it calls Get-ADGroupMember -Recursive and, for each member, computes the resultant PSO either by querying msDS-ResultantPSO (a constructed attribute populated by the DC) or by replaying the precedence evaluation locally: direct user assignment wins over group assignment, and within each tier the PSO with the lowest msDS-PasswordSettingsPrecedence value wins, with PSO objectGUID as a deterministic tiebreaker. The output enumerates every privileged account whose resultant policy is weaker than the configured baseline, every PSO with an empty msDS-PSOAppliesTo, and every PSO that targets a non-global-security group (which AD silently ignores, creating a phantom policy).
Valor recomendado
All privileged accounts covered by a strict FGPP. No policy gaps where high-value accounts fall back to a weaker default policy
Remediación
For each FGPP, review the msDS-PSOAppliesTo attribute to see target groups. Cross-reference with privileged group membership to verify coverage. Use Get-ADUserResultantPasswordPolicy for specific accounts to determine the effective policy. Fix any gaps in FGPP application
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1), AC-2
- CIS AD Benchmark
- 5.1.3
- MITRE ATT&CK
- T1110.001, T1078.002