AD-INF-001: Computers running unsupported Windows versions¶

medium high   Infrastructure   MITRE ATT&CK T1210   Reads: LDAP

Enabled computer accounts report a Windows version past Microsoft's end of extended support, which no longer receives security updates.

Also known as: obsolete-os

Why it matters¶

A Windows version past the end of extended support gets no security updates. Every remote code execution or privilege escalation bug published after that date stays open for good, and public exploits for old versions are easy to find. An attacker who reaches such a host on the network can often take it over without any credentials, then harvest the credentials of everyone who logs on to it.

Old systems also hold the domain back: they keep NTLMv1, SMBv1, RC4 or weak TLS alive, and an old domain controller blocks raising the functional level (AD-INF-003). A DC on an unsupported version is one exploit away from domain compromise.

How ad-doctor detects it¶

From the LDAP snapshot: every enabled computer account whose operatingSystem value matches a version in ad-doctor's end-of-support table, when that date is on or before the day of the scan. The table holds the end of extended support:

Versions not in the table (Windows 11, Windows Server 2022 and 2025, non-Windows hosts) are never reported. Domain controllers are recognised from userAccountControl (SERVER_TRUST_ACCOUNT). Each object is the account name and the reported version, for example OLD2008$ (Windows Server 2008 R2 Standard).

The check trusts what the computer last wrote to its own operatingSystem attribute; it does not connect to the hosts.

Severity¶

High when at least one reported computer is a domain controller: an unpatched DC is a direct route to the whole domain. Medium otherwise.

False positives and limits¶

• Extended Security Updates. Windows 10 is reported from 2025-10-14 and Windows Server 2008/2012 from their end dates even when the host is enrolled in the paid ESU program, which ad-doctor cannot see. Record enrolled hosts in an accepted-risk file with the ESU end date as the expiry.
• Long-term servicing editions. Windows 10 Enterprise LTSC releases have their own, later end dates but report Windows 10 in operatingSystem; accept them the same way.
• Stale accounts. A computer that was decommissioned but whose account is still enabled is reported too. That is a real finding: disable or delete the account.

Fix¶

1. List the hosts with their last logon, to separate live systems from stale accounts:

   Get-ADComputer -Filter 'Enabled -eq $true' -Properties OperatingSystem, LastLogonDate |
       Where-Object OperatingSystem -match 'Windows (XP|Vista|7|8|10)|Server (2003|2008|2012)' |
       Select-Object Name, OperatingSystem, LastLogonDate
   

2. Disable accounts of machines that no longer exist.

   Disable-ADAccount -Identity 'OLD2008$' -WhatIf
   

3. Upgrade or replace live systems with a supported version. For a domain controller, promote a new DC on a supported version, move any FSMO roles to it, then demote and remove the old one.

4. Isolate what cannot be upgraded yet: put it in its own network segment, block inbound SMB/RDP from user networks, keep administrators from logging on to it with tier-0 accounts, and enrol it in Extended Security Updates where available.

Verify¶

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-INF-001

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-INF-001"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

Related checks¶

• AD-INF-003
• AD-SEC-001

References¶

Microsoft and vendors

• Microsoft Lifecycle: search product and services lifecycle information
• Product Lifecycle FAQ: Extended Security Updates
• Extended Security Updates (ESU) program for Windows 10

MITRE ATT&CK

• T1210

Available since 0.1.0.