Skip to content

AD-ACL-008: Entra Connect sync account or server controllable outside tier 0

high   Permissions   MITRE ATT&CK T1098, T1003.006   Reads: LDAP

A principal outside tier 0 owns or can take over the Entra Connect sync account or its server, and that account can DCSync the domain.

Why it matters

With password hash sync, Entra Connect (formerly Azure AD Connect) runs as an on-premises connector account, MSOL_<hex> (or Sync_<server>_<hex> on older installs), that holds Replicating Directory Changes (All) on the domain. Its password is stored, encrypted, on the Entra Connect server, where a local administrator can recover it.

  1. An attacker who can reset the sync account's password, write its msDS-KeyCredentialLink, or rewrite its DACL becomes that account directly.
  2. Control of the server's computer object (RBCD, shadow credentials, full control) gives them administrator on the server, from which they extract the connector credentials.
  3. Either way they run DCSync and own the domain, and on the server they can also reach the cloud tenant through the Entra side of the sync.

AD-PRIV-011 reports when the server is not protected like a domain controller; this check reports who, in the directory, can take over either object.

How ad-doctor detects it

ad-doctor finds enabled accounts whose name matches the Entra Connect patterns (MSOL_ followed by 12 hex digits, or Sync_<server>_<12 hex digits>) and keeps those that hold both replication rights on the domain head (as in AD-ACL-001). The server is taken from the account name, or for MSOL_ accounts from the "running on computer ..." text Entra Connect writes into the description, and matched to a computer account.

For the sync account and its server it then reports, like AD-ACL-004:

  • an owner outside tier 0;
  • an ACE for a principal outside tier 0 and the operator groups (SELF and CREATOR OWNER ignored) granting full control, write, WriteDacl, WriteOwner, reset password, or a write to msDS-KeyCredentialLink, msDS-AllowedToActOnBehalfOfOtherIdentity or the User-Account-Restrictions property set that holds it, altSecurityIdentities or servicePrincipalName.

Objects look like MSOL_0a1b2c3d4e5f (sync account): helpdesk (reset password) or ENTRA01$ (sync server): srv_admins (write RBCD).

Attributes and probes read
  • sAMAccountName and description of MSOL_* and Sync_*_* accounts
  • nTSecurityDescriptor of the domain head (replication rights)
  • nTSecurityDescriptor (owner and effective ACEs) of the sync account and its server

Severity

Always high: the check only looks at sync accounts that hold both replication rights, so taking one over (or its server, where its password is stored) is a path to every password hash in the domain.

False positives and limits

  • Renamed or custom connector accounts that do not follow the MSOL_/Sync_ naming are not recognised; this is a false negative, not a false positive. Check the account configured in the Entra Connect wizard by hand.
  • Delegations to a group that is managed as tier 0 but is not one of the built-in tier-0 groups. Accept with an owner if that is deliberate (../ci.md#accepted-risks).

Fix

  1. Inspect the reported object (read-only):

    $dn = (Get-ADUser MSOL_0a1b2c3d4e5f).DistinguishedName   # or Get-ADComputer ENTRA01
$acl = Get-Acl "AD:$dn"
$acl.Owner
$acl.Access | Where-Object IdentityReference -like '*helpdesk*' |
    Format-Table ActiveDirectoryRights, ObjectType, IsInherited -AutoSize

  2. Move the sync account and the server into an OU only tier-0 admins control and stop inheriting OU-wide delegations (helpdesk password reset, server admin groups).

  3. Remove the explicit ACEs and reset the owner (review first; /R removes every ACE for the trustee on that object):

    # dsacls "CN=MSOL_0a1b2c3d4e5f,CN=Users,DC=corp,DC=example" /R "CORP\helpdesk"

  4. Harden the server as tier 0, as Microsoft recommends: only tier-0 admins, no delegation, Windows LAPS for its local administrator, and drop the replication rights if password hash sync is not used.

  5. If the rights may have been used, change the connector account's password (and update it in Entra Connect), and treat the domain's hashes as exposed: reset krbtgt twice and the passwords of privileged accounts.

Verify

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-ACL-008

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-ACL-008"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References

Microsoft and vendors

Research

MITRE ATT&CK

New in the next release.