Head to https://specterops.io/resources/adminsdholder/ to download the 159 page E-Book in PDF format.
I also wrote a little bit shorter blog to sumarize the topic in at least a hundred less pages.
Why am I so interested in AdminSDHolder? Well, it's one of the cornerstone security mechanisms in Active Directory. It's been around since Windows Server 2000 brought Active Directory to us 25+ years ago. And it's something that much of the Internet is confidently wrong about. Even Microsoft's primary documentation on AdminSDHolder gets several important details incorrect.
You can also check out the related GitHub repo which contains data points, scriptlets, lab results, and a little side story about how Microsoft has included malformed Access Control Entries in the default AdminSDHolder security descriptor since the first release of Windows Server 2000.
If for some reason the links on the SpecterOps website aren't working, the full PDF is available here as well.
]]>
It's exciting to be noted for my contributions to the IT and InfoSec community in the areas of Active Directory, Entra ID, and hybrid identity. I'm in great company as a Microsoft MVP and I look forward to having the opportunity to collaborate with and hopefully meet up with other MVPs in the future.
]]>Only Microsoft can remediate the underlying issues around BadSuccessor, but in the meantime we can mitigate the issue by focusing on the DACL abuses required for the attacker to gain control of a dMSA. I wrote up Understanding & Mitigating BadSuccessor to explore the DACL abuse primitives and ways to mitigate them. The blog also includes a reference to my GitHub where I've included PowerShell scripts which automate the hard work of creating ACEs on OUs and containers where dMSA accounts could reside.
TL;DR: BadSuccessor is a new AD attack primitive that abuses dMSAs, allowing an attacker who can modify or create a dMSA to escalate privileges and take over the forest. The DACL-based parts of the attack have relatively straightforward mitigations.
Recently Yuval Gordon at Akamai released the blog post BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory with some great research on abusing a new managed service account type for Active Directory which was released in Windows Server 2025. If you haven’t read that post in full yet, please do so before continuing on with this one.
In a nutshell, BadSuccessor allows anyone who can create or compromise a Delegated Managed Service Account (dMSA) in any AD Forest where at least 1 Windows Server 2025 Domain Controller (DC) is in place and a KDS Root Key has been generated to abuse the created or compromised dMSA to perform an Escalation of Privilege (EoP) to any security principal, including a member of Domain Admins. BadSuccessor can also be abused to recover the keys of a superseded account, which is a form of credential theft that can also result in full AD Forest compromise.
...read the rest of the blog here: Understanding & Mitigating BadSuccessor
Discovering and Remediating AD Object Ownership Issues
The default behavior in Active Directory allows the Owner of an AD Object to fully control that Object. Do you know who owns objects in your AD Forest? Do you know which AD Object Owners could compromise your AD Forest? Do you know who could own your AD Objects and who could Pwn your AD?
1.3
I may post some stuff here.
My posts would likely be about:
Hopefully I'll figure out how to use tags and collections.
]]>