Security principals with dangerous replication permissions
Active Directory security principals with Replicate Changes All permission enable attackers to execute DCSync attacks, exposing all user passwords.
Computer not resetting its password periodically
A non-expiring password on a computer account may indicate unauthorized access or control, allowing attackers to use pass-through authentication and potentially leading to more serious compromise.
AD computer using dNSHostName that belongs to another computer account
Attackers can exploit dNSHostName attribute modifications in Active Directory to impersonate computer accounts, compromising certificate-based authentication.
AD object with non-default primary group
Attackers can silently inherit elevated permissions and hide persistence in Active Directory through group membership manipulation by targeting a domain account with non-default primary group membership.
AD forest with high numbers of privileged group accounts
A high number of privileged group accounts in an Active Directory forest exposes administrators to unauthorized access and privilege escalation through lateral movement.
Active Directory Dangerous ACLs expose DFSR settings objects of the SYSVOL share
Active Directory Dangerous ACLs expose SYSVOL share replication settings, allowing attackers to exploit privilege escalation or persistence through unauthorized DFSR modifications.
AD domain accounts with password not required
Attackers can exploit AD domain accounts with password not required for unauthorized access, potentially leading to credential exposure and misuse.
AD domain account with Kerberos pre-authentication disabled
A domain account without Kerberos pre-authentication protection exposes attackers to offline password cracking opportunities.
Regular AD user account with permissions to modify DNS server objects
A regular AD user with DNS modification permissions exposes a high risk of privilege escalation and unauthorized access through attack paths involving DNS server object modifications.
AD domain account with password stored using reversible encryption
AD domain accounts with passwords stored using reversible encryption expose credentials to unauthorized parties who can decrypt and sign in anonymously, creating a vulnerability through administrative scope.