Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000137

Inactive AD domain controller

Critical
Active Directory
Credential Access Impact
v16

Signature Identity

CTD-000137
Threat ID
16
Version
IOE
Indicator Type

Threat Description

Some of your domain controllers haven’t been authenticating for over 45 days. This could indicate that their secrets haven’t been renewed, typically done every 30 days by default. To address this, you should check the connectivity and replication status between your domain controllers. Running diagnostics on the domain controllers, testing DNS, and examining Kerberos authentication can help identify and resolve the issue. If the issue persists, you may need to force a password change or reconfigure the affected domain controllers.

Note: If the ms-DS-Logon-Time-Sync-Interval Active Directory Schema attribute is greater than the Time Interval parameter defined in the threat rule, the accuracy of the threat rule results may be compromised. This discrepancy can lead to inaccurate detection outcomes, such as false positives or false negatives.

MITRE ATT&CK: Attack Tactics

Credential Access Impact

D3FEND: Defend Tactics

Restore Software

Remediation

  1. To open Command Prompt as Administrator:
    1. Press Win + X.
    2. Select Command Prompt (Admin) or Windows PowerShell (Admin).
  2. To open Ntdsutil:
    1. Type ntdsutil.
    2. Press Enter.
    3. Type metadata cleanup.
    4. Press Enter.
  3. To connect to a server and select the domain and server:
    1. Type connections.
    2. Press Enter.
    3. Type connect to server <YourDomainControllerName>. Replace <YourDomainControllerName> with the name of a working domain controller.
    4. Press Enter.
    5. Type quit.
    6. Press Enter.
    7. Type select operation target.
    8. Press Enter.
    9. Type list domains.
    10. Press Enter. This will list the domains in the forest.
    11. Type select domain <number>. Replace <number> with the number associated with your domain.
    12. Press Enter.
    13. Type list sites.
    14. Press Enter. This will list all the sites in your domain.
    15. Type select site <number>. Replace <number> with the number associated with the site where the DC you want to remove was located.
    16. Press Enter.
    17. Type list servers in site. This will list all the servers on the site.
    18. Press Enter.
    19. Type select server <number>. Replace <number> with the number associated with the DC you want to remove.
    20. Press Enter.
    21. Type quit.
    22. Press Enter.
  4. To remove the selected server:
    1. Type remove selected server.
    2. Press Enter.
    3. Confirm the removal when prompted.
  5. To clean up DNS and AD sites and services:
    1. Open the DNS Manager.
    2. Delete any Host (A or AAAA) records and Name Server (NS) records associated with the removed DC.
  6. To clean up Active Directory Sites and Services:
    1. Open Active Directory Sites and Services.
    2. Expand the site that contained the removed DC.
    3. Right-click the DC.
    4. Select Delete. 
  7. To verify that the DC has been removed, check Active Directory Users and Computers, DNS Manager and Active Directory Sites and Services

Frequently Asked Questions

What does Inactive AD domain controller mean?

An inactive AD domain controller is one that has not been authenticating users for over 45 days, indicating its Kerberos ticket-granting tickets (TGTs) and service tickets may have expired. This can lead to a loss of authentication capabilities in the Active Directory environment.

Inactive AD domain controllers are rated critical because they directly impact the security and integrity of the organization's authentication infrastructure, leaving it vulnerable to unauthorized access due to potential Kerberos ticket expiration and lack of secure authentication. Specifically, expired tickets can be exploited by attackers to gain unauthorized access to resources.

Attackers can potentially exploit inactive AD domain controllers by using them as a foothold for further attacks, but only if the expired tickets are not automatically renewed or replaced. This may lead to credential exposure or lateral movement, allowing attackers to gain unauthorized access and persist in the environment.

Cayosoft Guardian detects inactive AD domain controllers through continuous monitoring of authentication and authorization processes in the Active Directory environment, specifically tracking Kerberos ticket expiration and renewal. When an inactive domain controller is identified, Guardian flags it as a critical security issue, providing visibility into potential attack paths.

Cayosoft Guardian helps reduce the risk by alerting administrators to remove inactive domain controllers and clean up related DNS and Active Directory settings, ensuring that Kerberos ticket renewal and replacement processes remain secure and functional. This supports investigation and response efforts by providing a clear understanding of the security posture and enabling teams to respond quickly to potential threats.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Account protection Infrastructure
Attack Tactics
Credential Access Impact
Defend Tactics
Restore Software
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical