ADSTALE-002: Inactive Computer Accounts
- Plataforma
- Active Directory
- Categoría
- AD Stale & Obsolete Objects
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 0)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check performs an LDAP query against the configured naming context for objects of class computer where the userAccountControl flag ACCOUNTDISABLE (0x2) is not set and lastLogonTimestamp is older than the configured threshold (default 90 days, matching the Microsoft replication window for that attribute). For every match the check records: - sAMAccountName, distinguishedName, and objectSid - operatingSystem, operatingSystemVersion, and operatingSystemServicePack - lastLogonTimestamp converted to a UTC datetime and an age in days - pwdLastSet and the resulting machine-password age - userAccountControl flags (WORKSTATION_TRUST_ACCOUNT, SERVER_TRUST_ACCOUNT, TRUSTED_FOR_DELEGATION, TRUSTED_TO_AUTH_FOR_DELEGATION) - servicePrincipalName values (HOST/, CIFS/, MSSQLSvc/, TERMSRV/, WSMAN/, and any custom SPNs) - memberOf, with particular attention to privileged groups, file-share ACL groups, and groups that grant logon rights - msDS-AllowedToDelegateTo and msDS-AllowedToActOnBehalfOfOtherIdentity (resource-based constrained delegation) - adminCount and any non-default ACE on the object lastLogonTimestamp is used rather than lastLogon because it replicates between domain controllers; the check binds to a writable DC and accepts the documented 9-to-14-day update jitter when computing the age.
Por qué importa
A computer object in Active Directory is a security principal. It owns an NT hash derived from the machine password, it can be issued Kerberos tickets, and it can hold group memberships and ACL entries identical to a user account. When the physical system is decommissioned but the object is left enabled, three concrete risks remain. First, any cached copy of the machine credential (an old backup, a forensic image, a disposed disk, a stale SCCM secret store) becomes a valid logon credential against the domain for as long as the password is unchanged, and a stale computer account stops rotating its own password the moment the host stops booting. Second, an attacker with the ability to create or rename a computer object (the default ms-DS-MachineAccountQuota of 10 per authenticated user is sufficient) can stand up a new host with the same sAMAccountName, reset the machine password via SAMR or LDAP, and inherit the stale object's group memberships and delegation rights. Third, stale computers are routinely members of groups that grant blanket access to file shares, SQL servers, and management platforms; that access persists even after the underlying hardware is gone. Stale computer objects also distort BloodHound paths, hide unconstrained-delegation exposure that was never remediated, and inflate the apparent size of the estate in audit reports.
Ruta de ataque
1. Enumeration: from any authenticated context the attacker queries Search-ADAccount -AccountInactive -TimeSpan 90 -ComputersOnly, or runs a single LDAP filter ((&(objectClass=computer)(!userAccountControl:1.2.840.113556.1.4.803:=2)(lastLogonTimestamp<=<filetime>))). The query is readable by Authenticated Users and returns the full list of stale, enabled computers along with their group memberships. 2. Target selection: the attacker filters the result set for computers that are members of privileged groups, hold msDS-AllowedToDelegateTo entries, are TRUSTED_FOR_DELEGATION, or appear on share ACLs identified through SharpHound (CollectionMethod LocalGroup, ACL, GPOLocalGroup). 3. Credential recovery: if the attacker has access to a backup, a forensic image, or a previously dumped LSASS from the original host, the machine NT hash is extracted from the SECURITY hive ($MACHINE.ACC LSA secret) or from a cached registry export. The hash is valid for as long as the computer account password has not rotated, and a stale account never rotates. 4. Name reuse, if no cached credential is available: the attacker uses their default ms-DS-MachineAccountQuota allowance to create a new computer object, then renames or recreates one matching the stale sAMAccountName. Tools include impacket-addcomputer, StandIn, and PowerMad New-MachineAccount. Once owned, the attacker resets the password via NetUserChangePassword or Set-ADAccountPassword. 5. Authentication and lateral movement: with the machine credential in hand the attacker requests a TGT for the computer account (Rubeus asktgt /user:STALEHOST$ /rc4:<nthash>) and uses S4U2Self / S4U2Proxy where delegation rights exist, or directly accesses any resource where the computer account is on the ACL. Computer accounts on file-share ACLs, SQL logins, and management groups translate into immediate data access without touching a user account. 6. Persistence: the recovered or recreated computer account becomes a long-lived backdoor. Defenders rarely review computer-object logon activity, and a single stale account reactivated by the attacker can authenticate from anywhere with no alert.
Cómo lo evalúa Guerrilla
Guerrilla binds to a writable DC, reads the domain functional level and the configured inactivity threshold, and issues a single paged LDAP search with the filter (&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(lastLogonTimestamp<=<threshold-filetime>)). For each returned object the check pulls the supporting attributes (operatingSystem, pwdLastSet, servicePrincipalName, memberOf, msDS-AllowedToDelegateTo, msDS-AllowedToActOnBehalfOfOtherIdentity, adminCount) in the same round trip. Group membership is resolved against the domain SID so that any computer in Domain Admins, Enterprise Admins, Print Operators, Server Operators, Backup Operators, Account Operators, or a custom privileged group is surfaced as a high-severity finding rather than a routine stale-object finding. The lastLogon attribute is also collected from the bound DC and compared against lastLogonTimestamp so an analyst can detect cases where the replicated attribute is stale but the host actually logged on recently to a different DC. All queries are LDAP-only and do not require RSAT loaded on the scanning host.
Valor recomendado
No enabled computer accounts inactive for more than 90 days; inactive accounts disabled or removed
Remediación
Query computer accounts where lastLogonTimestamp is older than 90 days using Search-ADAccount -AccountInactive -TimeSpan 90 -ComputersOnly. Cross-reference with asset management systems to verify decommissioning status. Disable stale computer accounts and move to a Disabled Computers OU. Delete after a 60-day grace period if the system does not reconnect. Remove from security groups upon disabling
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-2(3)
- CIS AD Benchmark
- 9.1.2
- MITRE ATT&CK
- T1078.002