Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000193

Active Directory missing KDS root key required for gMSA support

High
Active Directory
Credential Access Privilege Escalation
v10

Signature Identity

CTD-000193
Threat ID
10
Version
IOE
Indicator Type

Threat Description

Group Managed Service Accounts (gMSAs) depend on the Key Distribution Service (KDS) and its Root Key to securely generate and distribute account passwords. The KDS Root Key enables domain controllers to create cryptographically strong, automatically managed passwords for gMSAs.

If the domain lacks a KDS Root Key, gMSA functionality is disabled, and any attempt to create or use gMSAs will fail. This misconfiguration forces services to rely on traditional accounts with manually rotated passwords, increasing administrative overhead and expanding the potential attack surface through weak or stale credentials.

MITRE ATT&CK: Attack Tactics

Credential Access Privilege Escalation

D3FEND: Defend Tactics

D3-ACH (Application Configuration Hardening)

Remediation

  1. On a Domain Controller, open Windows PowerShell with administrative privileges.
  2. Create the KDS Root Key by running: Add-KdsRootKey -EffectiveImmediately

    NOTE: It can take up to 10 hours for the key to replicate across all domain controllers.

  3. After replication completes, validate the KDS Root Key by running: Get-KdsRootKey
  4. Confirm that the output displays the KDS Root Key ID and creation date, indicating successful configuration.

Frequently Asked Questions

What does Active Directory missing KDS root key required for gMSA support mean?

The absence of the Key Distribution Service (KDS) Root Key in your domain disables Group Managed Service Accounts (gMSAs), forcing services to use traditional accounts with manually rotated passwords. This misconfiguration increases administrative overhead and expands the potential attack surface through weak or stale credentials.

This issue is rated high severity because it enables attackers to exploit Kerberos authentication, gaining unauthorized access and escalating privileges. Without the KDS Root Key, services rely on traditional accounts with manually rotated passwords, which can be weak or stale.

Attackers can exploit this issue by targeting traditional accounts with weak or stale passwords. They can use these credentials to gain unauthorized access, escalate privileges, and move laterally within the domain through Kerberos authentication.

Cayosoft Guardian continuously monitors the presence and configuration of the KDS Root Key across the Active Directory environment domain. When the KDS Root Key is found to be absent or misconfigured, Guardian flags it as a security issue so administrators are aware of the potential risk.

Cayosoft Guardian alerts administrators to create and configure the KDS Root Key, ensuring that the necessary security configuration is in place to enable secure gMSA functionality. Guardian also supports ongoing monitoring to catch any changes to the KDS Root Key configuration.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Infrastructure Privileged Access Management
Attack Tactics
Credential Access Privilege Escalation
Defend Tactics
D3-ACH (Application Configuration Hardening)
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical