ADTRADE-010: group Managed Service Account (gMSA) Posture & Password Exposure
- Plataforma
- Active Directory
- Categoría
- AD Adversary Tradecraft Indicators
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
group Managed Service Accounts (gMSA) hold 240-bit passwords that AD generates and rotates automatically, eliminating Kerberoasting of weak service-account passwords and manual rotation toil. Two posture concerns: (1) whether gMSAs are used at all for service identities, and (2) who is authorised to retrieve the managed password, controlled by the msDS-GroupMSAMembership security descriptor (PrincipalsAllowedToRetrieveManagedPassword). If that descriptor grants a broad principal (Everyone, Authenticated Users, Domain Users) or a non-privileged principal, that principal can recover the cleartext gMSA password (e.g. GMSAPasswordReader) and fully impersonate the service.
Valor recomendado
Service identities run as gMSAs; msDS-GroupMSAMembership is scoped to only the specific hosts that must run the service (no broad or non-privileged principals).
Remediación
For each gMSA, set PrincipalsAllowedToRetrieveManagedPassword to the exact computer accounts (or a tightly-scoped group) that run the service: Set-ADServiceAccount -Identity <gmsa> -PrincipalsAllowedToRetrieveManagedPassword <hosts>. Remove Everyone / Authenticated Users / Domain Users from that list. Where service accounts still use static user-account passwords, migrate them to gMSAs to gain automatic rotation and Kerberoasting resistance.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5, AC-6
- ANSSI
- vuln2_gmsa_principalsallowedtoretrievemanagedpassword
- CIS AD Benchmark
- 6.5.1
- MITRE ATT&CK
- T1552, T1558.003