Skip to content

AD-ACC-010: Pre-created computer accounts with predictable passwords

high   Accounts   MITRE ATT&CK T1078.002   Reads: LDAP

Pre-created computer accounts that were never used still have the lower-cased computer name as their password, so anyone can take them over.

Also known as: pre2k-computers

Why it matters

When a computer account is created with Assign this computer account as a pre-Windows 2000 computer, its password is set to the computer name in lower case (without the $). The same happens when an admin uses Reset Account on such an account. The password stays predictable until a machine actually joins with the account and changes it.

An attacker lists the enabled computers with PASSWD_NOTREQD and a logonCount of 0 and tries the lower-cased name. A logon then fails with STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT, which confirms the password; the attacker changes it (or requests a Kerberos ticket) and owns a domain computer account. That is enough for authenticated enumeration, and it gives the attacker the account with an SPN that resource-based delegation attacks need (AD-DEL-003), without using the machine account quota (AD-POL-002).

How ad-doctor detects it

From the LDAP snapshot: every enabled computer that is not a domain controller, has PASSWD_NOTREQD (0x20) in userAccountControl and a logonCount of 0. Accounts for which logonCount came back empty are skipped.

logonCount is not replicated: the value is the one held by the DC ad-doctor queried. The same accounts are also reported, less specifically, by AD-ACC-001.

Each object is the computer's sAMAccountName, for example PRE2K$.

Attributes and probes read
  • userAccountControl
  • logonCount
  • objectClass

Severity

Always high: the password is predictable from the account name, and a computer account is a working domain identity (LDAP queries, Kerberos tickets, RBCD targets).

False positives and limits

  • A computer that joined through another DC. Its logons were counted there, so the queried DC still shows 0. Its password is a random machine password; clear PASSWD_NOTREQD and the finding goes away.

Fix

  1. List the candidates (read-only):

    Get-ADComputer -LDAPFilter '(userAccountControl:1.2.840.113556.1.4.803:=32)' `
    -Properties logonCount, whenCreated, pwdLastSet |
    Where-Object { $_.Enabled -and $_.logonCount -eq 0 } |
    Select-Object Name, whenCreated, logonCount

  2. Delete accounts no machine will use, or disable them until the machine is built:

    Remove-ADComputer PRE2K -WhatIf

  3. For accounts that must stay, set a random password with PowerShell. Do not use Reset Account in Active Directory Users and Computers: that sets the lower-cased name again.

    Add-Type -AssemblyName System.Web
$pw = [System.Web.Security.Membership]::GeneratePassword(64, 16)
Set-ADAccountPassword 'PRE2K$' -Reset -NewPassword (ConvertTo-SecureString $pw -AsPlainText -Force) -WhatIf

  4. Clear PASSWD_NOTREQD. This is what ad-doctor fix generates; on its own it does not change the password, so do step 2 or 3 first.

    Set-ADAccountControl 'PRE2K$' -PasswordNotRequired $false -WhatIf

  5. Stop creating them: pre-stage computers without the pre-Windows 2000 option.

Verify

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-ACC-010

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-ACC-010"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References

Specifications

Research

Tools

MITRE ATT&CK

Available since 0.1.0.