AD domain with unsecure RBCD delegation on domain controllers

This vulnerability allows attackers to bypass normal authentication and access controls, enabling them to access sensitive resources and data without proper authorization. The attacker's ability to create unauthorized Kerberos service tickets for any user makes this a critical issue.

Attackers can use the modified RBCD settings to obtain a Kerberos ticket-granting service (TGS) ticket for any user, allowing them to access sensitive resources and data without proper authentication. This enables lateral movement and escalation of privileges.

Cayosoft Guardian continuously monitors the permissions and access controls on your domain controllers, detecting non-privileged users with write access to RBCD settings and flagging this as a security issue for administrators to address.

Cayosoft Guardian alerts administrators to remove unwanted users or groups from RBCD settings, limiting the ability of attackers to create unauthorized Kerberos service tickets and reducing the risk of severe compromise. This helps provide visibility into potential attack paths and supports investigation and response efforts.