ADPWD-003: Análisis de aplicación de FGPP
- Plataforma
- Active Directory
- Categoría
- AD Password & Lockout Policies
- Severidad
- Medium
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las políticas de contraseñas de grano fino deben aplicarse a los grupos correctos para ser eficaces. Una aplicación mal configurada de una FGPP puede dejar cuentas de alto valor bajo políticas más débiles o crear brechas de política en las que no se aplique ninguna FGPP y se utilice en su lugar la Default Domain Policy
Por qué importa
FGPPs were introduced in Windows Server 2008 to allow stronger password requirements for privileged accounts and service accounts without raising the floor for the entire domain. The mechanism is opt-in: an account that is not directly assigned a PSO, and is not a member of a global security group assigned a PSO, falls back to the Default Domain Policy (often 7-character or 8-character minimum, complexity sometimes disabled in legacy domains). When a Domain Admin or Tier 0 service account is left on the default policy, the attacker only needs to crack one 8-character NTLM hash to obtain forest dominance, a workload that is well under one hour on a single modern GPU rig. The misconfiguration also creates audit findings under PCI DSS 8.3, NIST SP 800-53 IA-5(1), and CIS Microsoft Active Directory Benchmark 5.1.3, all of which require demonstrably stronger controls on privileged identities. Real-world incident response cases consistently show that FGPPs are either absent, applied only to a "ServiceAccounts" group that has long since drifted out of date, or applied with a precedence higher than a weaker legacy PSO that wins the resultant-set evaluation.
Ruta de ataque
Step 1: Enumeration. With any authenticated user the attacker queries the Password Settings Container (LDAP filter (objectClass=msDS-PasswordSettings)). All authenticated users can read PSO metadata by default unless the DACL on the container has been hardened. The attacker records each PSO precedence, settings, and applies-to set. Step 2: Gap analysis. The attacker enumerates privileged groups (Get-ADGroupMember -Recursive on Domain Admins, Enterprise Admins, Administrators, the protected groups under AdminSDHolder) and identifies members whose msDS-ResultantPSO is null or points to the Default Domain Policy. Step 3: Target selection. The attacker picks a Domain Admin or kerberoastable service account whose effective policy permits short or non-complex passwords. Service accounts with SPNs are particularly valuable because the attacker can request a service ticket and crack the RC4 or AES hash offline. Step 4: Credential acquisition. For kerberoastable targets the attacker runs Rubeus kerberoast /user:svc_target or GetUserSPNs.py. For interactive accounts the attacker can attempt password spraying (T1110.003) against the weaker policy threshold without triggering lockout, or run an offline crack against a captured NTDS.dit extract. Step 5: Cracking. Hashcat -m 13100 (Kerberos 5 TGS-REP etype 23) or -m 1000 (NTLM) against the captured material. An 8-character password with mixed case and digits falls in hours; without complexity it falls in minutes. Step 6: Privilege use. The cracked credential is used directly (interactive logon, RDP, WinRM) or to forge a TGT (S4U2Self for protocol transition, or to request additional service tickets). Tier 0 reach is achieved without ever touching a DC interactively, leaving minimal forensic trail.
Cómo lo evalúa Guerrilla
Guerrilla binds anonymously or as the current user to the default naming context and reads CN=Password Settings Container,CN=System,DC=<domain>. The check enumerates every child object of class msDS-PasswordSettings and pulls the full PSO attribute set in one paged LDAP query. For each privileged group (built from a curated list plus any group with adminCount=1) it calls Get-ADGroupMember -Recursive and, for each member, computes the resultant PSO either by querying msDS-ResultantPSO (a constructed attribute populated by the DC) or by replaying the precedence evaluation locally: direct user assignment wins over group assignment, and within each tier the PSO with the lowest msDS-PasswordSettingsPrecedence value wins, with PSO objectGUID as a deterministic tiebreaker. The output enumerates every privileged account whose resultant policy is weaker than the configured baseline, every PSO with an empty msDS-PSOAppliesTo, and every PSO that targets a non-global-security group (which AD silently ignores, creating a phantom policy).
Valor recomendado
Todas las cuentas privilegiadas cubiertas por una FGPP estricta. Sin brechas de política en las que las cuentas de alto valor recaigan en una política predeterminada más débil
Remediación
Para cada FGPP, revise el atributo msDS-PSOAppliesTo para ver los grupos de destino. Coteje con la pertenencia a grupos privilegiados para verificar la cobertura. Utilice Get-ADUserResultantPasswordPolicy en cuentas concretas para determinar la política efectiva. Corrija cualquier brecha en la aplicación de las FGPP
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1), AC-2
- CIS AD Benchmark
- 5.1.3
- MITRE ATT&CK
- T1110.001, T1078.002