Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000215

AD domain controller without or weak BitLocker drive encryption policy

Medium
Active Directory
Defense Evasion Privilege Escalation

Signature Identity

CTD-000215
Threat ID
Version
IOE
Indicator Type

Threat Description

A domain controller that has no BitLocker drive encryption policy applied through Group Policy, or that has a policy with weak settings, might store the Active Directory database (Ntds.dit), the SYSVOL folder, and the registry hives on drives that aren’t encrypted, or that are encrypted with a weak cipher and have no recovery information backed up to Active Directory. A threat actor who gets physical access to the server, or access to its virtual hard disk files, backups, or snapshots, can mount the drive offline and extract the password hashes of every domain account, including krbtgt. Without a policy, encryption depends on manual setup on each domain controller, which is easy to miss when you deploy a new domain controller or restore one from backup.

Example: A threat actor with access to the virtualization host copies the VHDX file of a domain controller. No BitLocker policy enforces encryption, so the disk isn’t encrypted. The threat actor attaches the file to another computer, copies Ntds.dit and the SYSTEM hive, and extracts the NTLM hashes of all domain accounts offline. None of this generates events on the domain controller.

MITRE ATT&CK: Attack Tactics

Defense Evasion Privilege Escalation

D3FEND: Defend Tactics

D3-PH (Platform Hardening)

Remediation

Configure a Group Policy Object (GPO) that sets strong BitLocker encryption, and link it to the Domain Controllers organizational unit.

  1. Open the Group Policy Management console.
  2. Do one of the following:
    • To use an existing GPO, right-click a GPO linked to the Domain Controllers organizational unit, and then select Edit.
    • To create a GPO, right-click the Domain Controllers organizational unit, select Create a GPO in this domain, and Link it here, enter a name, and then right-click the new GPO and select Edit.
  3. Go to Computer Configuration > Policies > Administrative Templates > Windows Components > BitLocker Drive Encryption.
  4. Open Choose drive encryption method and cipher strength (Windows 10 (Version 1511) and later), select Enabled, and set operating system drives to XTS-AES 256-bit.
  5. On each domain controller, run gpupdate /force, or wait for the next Group Policy refresh.

More information:Configure BitLocker

Frequently Asked Questions

What does AD domain controller without or weak BitLocker drive encryption policy mean?

A domain controller without or weak BitLocker drive encryption policy means that the domain controller's drives are not encrypted or are encrypted with insufficient settings, making it vulnerable to unauthorized access and data extraction. This allows attackers to extract password hashes and potentially escalate privileges.

A domain controller without or weak BitLocker drive encryption policy allows attackers to extract password hashes and potentially escalate privileges, but it does not provide direct access to sensitive data or enable lateral movement. However, it still poses a risk to the security of the domain and its users.

Attackers can mount the domain controller's drive offline, extract the password hashes of every domain account, and use them to attempt privilege escalation or unauthorized access to the domain. This can also support further attacker activity such as lateral movement and privilege escalation.

Cayosoft Guardian continuously monitors for AD domain controller without or weak BitLocker drive encryption policy and alerts administrators when the condition is detected. This provides visibility into the exposure so security teams can review the finding and determine whether investigation or response is required. Guardian monitors Active Directory for this condition and flags it when detected.

Cayosoft Guardian helps reduce the risk of AD domain controller without or weak BitLocker drive encryption policy by alerting administrators when the condition is detected and providing visibility into the affected accounts, groups, permissions, and configurations. This helps security teams identify exposure more quickly and respond before the issue contributes to a larger security event.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Infrastructure
Attack Tactics
Defense Evasion Privilege Escalation
Defend Tactics
D3-PH (Platform Hardening)
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical