AD forest with anonymous access enabled over Name Service Provider Interface
Anonymous RPC-based binds via Name Service Provider Interface expose AD forest to reconnaissance and initial access.
AD domain controller allowing vulnerable Netlogon secure channel connections
An unauthenticated attacker can exploit a domain controller’s vulnerable Netlogon secure channel connection, changing AD passwords and escalating privileges.
Anonymous access enabled in AD forest
Enabled anonymous access in Active Directory (AD) forest exposes sensitive information via LDAP queries, allowing unauthenticated users to gather user and group details.
Security principals with dangerous replication permissions
Active Directory security principals with Replicate Changes All permission enable attackers to execute DCSync attacks, exposing all user passwords.
User account with old passwords
Old Active Directory passwords expose users to unauthorized access if not regularly updated.
Computer not resetting its password periodically
A non-expiring password on a computer account may indicate unauthorized access or control, allowing attackers to use pass-through authentication and potentially leading to more serious compromise.
AD forest is not protected against forest-wide failure by Cayosoft Guardian
A high-severity threat where an AD forest lacks a safeguard to quickly recover from catastrophic events like ransomware attacks or directory data corruption, exposing it to prolonged downtime, significant data loss, and substantial business disruption.
AD domain allowing NTLM authentication
AD domains using NTLM authentication expose sensitive information, enabling attackers to gather domain details through unauthorized access.
AD object created by unusual Initiator
Cayosoft Guardian detects anomalous Active Directory account creation by unusual Initiators, exposing potential attack paths and helping administrators investigate and remediate security issues.
AD domain with misconfigured LDAP signing policy on the domain controllers
A misconfigured LDAP signing policy on Active Directory domain controllers exposes the environment to man-in-the-middle attacks, allowing attackers to intercept authentication traffic.