Skip to content

AD-ACL-007: Exchange groups with rights over the domain (PrivExchange)

medium high   Permissions   MITRE ATT&CK T1098, T1557.001, T1003.006   Reads: LDAP

Exchange security groups hold WriteDacl over the domain, so control of any Exchange server (or a relayed Exchange authentication) becomes DCSync.

Also known as: privexchange

Why it matters

Exchange setup (/PrepareAD) grants its groups broad rights in the domain so Exchange can manage recipients. Before the February 2019 updates, Exchange Windows Permissions held WriteDacl on the domain object. Exchange servers are members of that group through Exchange Trusted Subsystem, so:

  1. An attacker with any mailbox calls the EWS PushSubscription API and makes the Exchange server authenticate to a host they control (PrivExchange).
  2. They relay that NTLM authentication to LDAP on a domain controller.
  3. Acting as the Exchange server, they add Replicating Directory Changes (All) for themselves to the domain DACL and run DCSync.

The relay needs DCs that accept LDAP without signing or channel binding (AD-INF-005, AD-INF-010), but any compromise of an Exchange server, by an exploit for example, leads to the same place without a relay.

How ad-doctor detects it

ad-doctor finds the groups Exchange creates (Exchange Windows Permissions, Exchange Trusted Subsystem, Organization Management) by name and reads the DACL of the domain head with the SD flags control, which an ordinary user may do.

  • Effective ACEs on the domain object granting one of these groups WriteDacl, WriteOwner, GenericAll or DS-Replication-Get-Changes-All make the finding high.
  • Inheritable ACEs that apply to user objects, group objects or all descendants and grant WriteDacl, WriteOwner or GenericAll make it medium when nothing direct is found.

The finding names each right and lists the non-group members behind those groups, which are normally the Exchange servers' computer accounts (for example EXCH01$). Exchange servers are also added to the control graph, so AD-PATH-001 shows who else can reach tier 0 through them.

Attributes and probes read
  • nTSecurityDescriptor of the domain head (effective and inheritable ACEs)
  • member of Exchange Windows Permissions, Exchange Trusted Subsystem, Organization Management

Severity

High when an Exchange group holds WriteDacl, WriteOwner, full control or Replicating Directory Changes All on the domain object itself (the pre-2019 PrivExchange state). Medium when the rights are only inheritable to user and group objects (the state left by the February 2019 fix): whoever controls Exchange can still take over any account that AdminSDHolder does not protect.

False positives and limits

  • Exchange already removed. If Exchange was uninstalled but its groups and ACEs were left behind, the finding is real (anyone who can add themselves to those groups inherits the rights) but the fix is simply to remove the ACEs and the groups.
  • Split permissions. Organizations on Active Directory split permissions no longer have these ACEs; if the finding persists, /PrepareAD was not rerun after the switch.

Fix

  1. See what is there.

    $domain = (Get-ADDomain).DistinguishedName
(Get-Acl "AD:$domain").Access |
    Where-Object { $_.IdentityReference -like '*Exchange*' -and
                   $_.ActiveDirectoryRights -match 'WriteDacl|WriteOwner|GenericAll' } |
    Format-Table IdentityReference, ActiveDirectoryRights, InheritanceType,
                 PropagationFlags, InheritedObjectType -AutoSize

    PropagationFlags = InheritOnly means the 2019 fix is applied and the finding is the medium variant.

  2. Install a supported Exchange cumulative update and rerun /PrepareAD, which rewrites the ACEs as inherit-only:

    Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /PrepareAD

    Exchange 2010 needs the manual steps in KB4490059.

  3. Remove the remaining rights with Active Directory split permissions if your organisation can create recipients with AD tools instead of Exchange:

    Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /PrepareAD /ActiveDirectorySplitPermissions:true

  4. Close the relay path: require LDAP signing and LDAPS channel binding on every DC, and keep Extended Protection on Exchange (on by default since Exchange 2019 CU14).

  5. Until the rights are gone, treat Exchange servers as tier 0: patch them first, restrict who administers them, and watch them like domain controllers.

  6. Exchange decommissioned? Remove the ACEs from the domain object (review first; this removes every ACE for that trustee):

    # dsacls "DC=corp,DC=example" /R "CORP\Exchange Windows Permissions"

Verify

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-ACL-007

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-ACL-007"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References

Microsoft and vendors

Research

Tools

MITRE ATT&CK

New in the next release.