Skip to content

AD-ACC-008: Passwords in description or info attributes

medium   Accounts   MITRE ATT&CK T1552   Reads: LDAP

The description or info attribute of enabled accounts appears to contain a password, readable by the scanning user and anyone with the same rights.

Why it matters

Help desks and admins write temporary passwords into the Description or Notes field of an account ("temp pwd: Welcome2026") because it is convenient. Those attributes are not secret: ad-doctor read them as an ordinary domain user, so every account with the same rights can read them too.

Dumping all user descriptions is one of the first things an attacker does after getting any foothold (for example NetExec's get-desc-users module). A password found there often still works, or shows the pattern used for every new account.

How ad-doctor detects it

From the LDAP snapshot: every enabled account whose description and info values, joined together, match a pattern of a password keyword followed by : or = and at least three non-space characters. The keywords are pass, password, passwd, pwd and the Turkish, German, Spanish and French words for password (parola, şifre, sifre, kennwort, contraseña, mot de passe), case-insensitive.

The matched text is not copied into the report or the snapshot, only the fact that it matched. Each object is the account's sAMAccountName, for example notes_user.

Attributes and probes read
  • description
  • info

Severity

Always medium. The match is a text pattern, not a confirmed credential, and the password may already have been changed.

False positives and limits

  • Text that names a password without containing one, such as Password: see vault or pwd=never expires. Rewrite it, or record it in an accepted-risk file.
  • Passwords written without a : or = (pw Welcome1) are not found.

Fix

  1. Read the matching text yourself (read-only):

    Get-ADUser notes_user -Properties Description, info | Select-Object SamAccountName, Description, info

  2. Change the password of every reported account first: assume the text has been read.

    Set-ADAccountPassword notes_user -Reset -NewPassword (Read-Host -AsSecureString 'New password') -WhatIf

  3. Remove the text (or replace it with something that is not a secret):

    Set-ADUser notes_user -Clear description, info -WhatIf

  4. Fix the habit: hand out initial passwords out of band, with User must change password at next logon set, instead of writing them into the directory.

Verify

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-ACC-008

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-ACC-008"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References

Specifications

Research

MITRE ATT&CK

Available since 0.1.0.