Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000168

AD domain controller deployed as a VM without drive encryption

High
Active Directory
Defense Evasion Privilege Escalation
v8

Signature Identity

CTD-000168
Threat ID
8
Version
IOE
Indicator Type

Threat Description

Deploying Active Directory domain controllers as virtual machines without drive encryption exposes sensitive data at rest. In case of theft, compromise, or unauthorized access to the virtual hard disk (VHD) files, an attacker could extract credentials or other sensitive information. Drive encryption such as BitLocker with TPM ensures protection against these risks.

MITRE ATT&CK: Attack Tactics

Defense Evasion Privilege Escalation

D3FEND: Defend Tactics

D3-PH (Platform Hardening)

Remediation

  1. Verify that the operating system supports BitLocker encryption.
  2. Add the BitLocker feature using Server Manager or PowerShell: Install-WindowsFeature -Name BitLocker
  3. Use Group Policy to enforce AES 128-bit or 256-bit encryption.
  4. Apply BitLocker to all virtual hard disks (VHD/VHDX) associated with the domain controller.
  5. Start encryption using PowerShell: Enable-BitLocker -MountPoint <Drive> -EncryptionMethod Aes256
  6. Save recovery keys in Active Directory (AD DS) or a hardware security module (HSM).
  7. Regularly audit key storage to detect unauthorized access.
  8. Ensure the host machine has a Trusted Platform Module (TPM) and enable it in BIOS/UEFI.
  9. If using Hyper-V, expose TPM to guest VMs, open Hyper-V Manager > Edit VM Settings > Navigate to Security > Enable Trusted Platform Module.
  10. Set up a PIN or startup key alongside TPM for additional security.
  11. Use Manage-bde or Group Policy to enforce this setting.
  12. Save the startup key securely on a removable drive or network location.
  13. Perform encryption and decryption tests on a non-production VM before applying changes to domain controllers.
  14. Verify that the VM successfully boots with TPM and startup key requirements.
  15. Conduct periodic audits and recovery key functionality checks.

Frequently Asked Questions

What does AD domain controller deployed as a VM without drive encryption mean?

AD domain controllers running in unencrypted virtual machine hard drives expose sensitive data at rest, including credentials and other information, to potential attackers who gain access to the virtual machine through compromised virtualization layer.

This configuration directly exposes sensitive data at rest due to lack of encryption, making it easily accessible to unauthorized users who can extract credentials or other information through virtual machine compromise. The attacker gains access to the virtual machine and can extract sensitive data at rest.

Attackers can gain access to the virtual machine, extract sensitive data at rest, including credentials, keys, and other information that could be used for malicious activities. The attacker gains capability to read and write sensitive data.

Cayosoft Guardian continuously monitors the configuration of virtual machines to identify those missing drive encryption, providing administrators with visibility into systems requiring remediation to protect sensitive data. The guardian detects lack of drive encryption and provides visibility.

Cayosoft Guardian alerts administrators to remediate the issue by enabling BitLocker encryption, securely saving recovery keys, and configuring TPM settings to protect sensitive data at rest. The guardian assists response by providing visibility into systems requiring remediation.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Infrastructure
Attack Tactics
Defense Evasion Privilege Escalation
Defend Tactics
D3-PH (Platform Hardening)
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical