ADPWD-009: Users with Password Never Expires
- Plataforma
- Active Directory
- Categoría
- AD Password & Lockout Policies
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check issues an LDAP query (&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) against the default naming context. The bitwise AND matching rule (OID 1.2.840.113556.1.4.803) returns objects whose userAccountControl has bit 0x10000 (DONT_EXPIRE_PASSWORD, 65536 decimal) set and bit 0x2 (ACCOUNTDISABLE) cleared, so only enabled accounts surface. For each result the check pulls userAccountControl, pwdLastSet, lastLogonTimestamp, memberOf, adminCount, objectClass, msDS-ManagedPasswordInterval (present only on gMSAs), and servicePrincipalName. It then classifies the account: - Group Managed Service Account (objectClass contains msDS-GroupManagedServiceAccount): treated as compliant because the KDS rotates the 240-byte password on the msDS-ManagedPasswordInterval cadence. - Delegated Managed Service Account (objectClass contains msDS-DelegatedManagedServiceAccount, Windows Server 2025): treated as compliant for the same reason. - Standard user (objectClass = user with no managed service account class): flagged. Severity is escalated when the account is in a Tier 0 group (Domain Admins, Enterprise Admins, Schema Admins, BUILTIN\Administrators), when adminCount = 1, or when servicePrincipalName is populated (Kerberoasting amplification). The check also computes effective age = (now - pwdLastSet) in days so the operator can see how long a static credential has been in circulation, and it captures whether the account has logged on since the password was set (lastLogonTimestamp > pwdLastSet) to distinguish active stale credentials from dormant ones.
Por qué importa
Password rotation is a layered defense against credential exposure that the defender cannot see. Phishing, keylogging on a personally owned device, paste-bin dumps, NTDS theft from a backup tape, MSSQL link credentials, browser-saved credentials, infostealer logs sold on Russian Market and Genesis Market, and accidental disclosure in scripts or wikis all expose passwords without producing a detectable event in the domain. Maximum password age caps the useful life of any leaked credential at the policy interval (commonly 60 to 365 days). DONT_EXPIRE_PASSWORD removes that cap entirely: the password is valid until an administrator notices and resets it, which in practice means until an incident forces a domain-wide rotation. Service accounts, executive accounts, and break-glass accounts are the most commonly flagged, and they are also the highest-value: service accounts typically hold broad rights and SPNs (which makes them Kerberoastable and turns a static password into an offline-crackable hash that any authenticated user can request), executive accounts often have mailbox and SharePoint access that aids business email compromise, and break-glass accounts have Domain Admin by definition. Mandiant and the Verizon DBIR have both documented intrusions where the initial foothold was a service account credential whose pwdLastSet was years old and whose DONT_EXPIRE_PASSWORD flag prevented natural rotation. The control is also a CIS Critical Security Control 5.3 requirement and a finding under every PCI DSS, HIPAA, FedRAMP, and ISO 27001 assessment.
Ruta de ataque
Step 1: Credential acquisition. The attacker obtains a password for a target account through one of many channels: NTDS.dit theft from an unprotected backup, dump of cached credentials from a workstation (LSASS, DPAPI, browser stores), an infostealer log purchased from a marketplace, a public breach corpus correlated by email address, or a phishing landing page. Because DONT_EXPIRE_PASSWORD accounts often appear in old leak corpora, the attacker may not need to compromise anything live to obtain the credential. Step 2: Validation. The attacker tests the credential against the target domain. Guerrilla, Rubeus asktgt, kinit, or simple SMB authentication to the netlogon share will confirm validity without touching the user. Because the password has not changed, a credential from a 2019 dump still authenticates in 2026. Step 3: Reconnaissance. The attacker enumerates the account: BloodHound (SharpHound -CollectionMethod All) maps group memberships, SPNs, delegations, and outbound edges from the principal. PowerView Get-DomainUser -Identity target shows pwdLastSet, lastLogon, and userAccountControl. If DONT_EXPIRE_PASSWORD is set the attacker knows the credential will not rotate out from under them and plans persistence accordingly. Step 4: Lateral movement. With service account credentials the attacker pivots via the rights granted to that account: SQL sysadmin into linked servers, Exchange Trusted Subsystem into the Exchange organization, backup operator into the NTDS database, or constrained delegation into the targets configured services. With executive account credentials the attacker pivots into mailbox content, Teams, OneDrive, and shared file servers. Step 5: Kerberoasting amplification. If the flagged account also has a servicePrincipalName, any authenticated user can request a TGS-REP encrypted with the account password key. The attacker need not even possess the credential up front: they request the ticket and crack it offline. DONT_EXPIRE_PASSWORD guarantees the recovered password remains valid indefinitely after the crack completes, even if cracking takes weeks (see ADKERB-002 for the encryption type interaction). Step 6: Persistence. The attacker stages the credential in their own toolkit (CME, Impacket, Cobalt Strike) and uses it for re-entry across the engagement. Because rotation will not occur naturally, the only defender action that closes the door is manual identification and reset, which is exactly what ADPWD-009 enables.
Cómo lo evalúa Guerrilla
Guerrilla performs a paged LDAP search against the closest writable DC with the AD bitwise-AND matching rule to filter on userAccountControl bits server-side, avoiding the cost of pulling every user and filtering client-side. The matching rule OID 1.2.840.113556.1.4.803 (LDAP_MATCHING_RULE_BIT_AND) is documented in MS-ADTS section 3.1.1.3.4.4.2 and is supported by every supported version of AD DS. The filter is (&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) so disabled accounts are excluded at the server. For each match the check requests userAccountControl, pwdLastSet (Windows FileTime), lastLogonTimestamp (replicated, accurate within msDS-LogonTimeSyncInterval days, default 14), memberOf (expanded with tokenGroups where needed), adminCount, objectClass, servicePrincipalName, and msDS-ManagedPasswordInterval. Account classification distinguishes msDS-GroupManagedServiceAccount and msDS-DelegatedManagedServiceAccount objects (compliant) from plain user objects (flagged). Output includes SamAccountName, DistinguishedName, pwdLastSetAgeDays, lastLogonAgeDays, isTier0, hasSpn, and a recommendation field that names the closest remediation action (rotate, migrate to gMSA, disable, or document exception). The check is read-only, requires only authenticated user privileges, and does not modify any object.
Valor recomendado
No user accounts with Password Never Expires. Only Group Managed Service Accounts may have automatic rotation exemptions
Remediación
Identify accounts using Get-ADUser -Filter {PasswordNeverExpires -eq $true -and Enabled -eq $true} -Properties PasswordNeverExpires. Review each account for business justification. Clear the flag on user accounts and migrate service accounts to gMSA where possible. Document any approved exceptions with compensating controls
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1)
- CIS Benchmark
- 1.1.4
- ANSSI
- R36
- CIS AD Benchmark
- 5.4.1
- MITRE ATT&CK
- T1078.002