Skip to content

AD-KRB-006: Seamless SSO key not rolled over

medium   Kerberos   MITRE ATT&CK T1558.002   Reads: LDAP

The Kerberos key of the Entra ID Seamless SSO account AZUREADSSOACC$ is older than 30 days; whoever holds it can forge tickets to Entra ID.

Also known as: seamless-sso, azureadssoacc

Why it matters

Seamless single sign-on lets domain-joined machines sign in to Microsoft Entra ID with Kerberos. Entra Connect creates a computer account, AZUREADSSOACC$, that stands for Entra ID in the on-premises forest, and shares that account's Kerberos key with Entra ID. Browsers then get an ordinary service ticket for it and Entra ID decrypts the ticket with the shared key.

Anyone who obtains that key (by DCSync, from ntds.dit, or from a DC backup) can forge a service ticket for any synced user (a silver ticket) and sign in to Entra ID as them, from anywhere, without that user's password. The key does not change by itself, so a key stolen months ago keeps working until someone rolls it over.

How ad-doctor detects it

From the LDAP snapshot: the account whose sAMAccountName is AZUREADSSOACC$, and its pwdLastSet. ad-doctor reports it when the password is more than 30 days older than the snapshot, and gives the age:

The AZUREADSSOACC$ Kerberos key is 95 days old; whoever has it can forge tickets to
Entra ID for any synced user (silver ticket).

The object is AZUREADSSOACC$. The account is checked whether or not it is enabled. When Seamless SSO was never set up, the account does not exist and the check is silent.

Attributes and probes read
  • sAMAccountName
  • pwdLastSet

Severity

Always medium: the check fires only when the AZUREADSSOACC$ password is more than 30 days old, the rollover interval Microsoft recommends.

False positives and limits

  • Seamless SSO was turned off but the account was left behind. The finding is still worth acting on: follow Microsoft's clean-up steps and delete AZUREADSSOACC$, which removes the key entirely.

Fix

  1. Check the age (read-only):

    Get-ADComputer AZUREADSSOACC -Properties PasswordLastSet |
    Select-Object Name, PasswordLastSet

  2. Roll the key over on the Entra Connect server, as in Microsoft's FAQ. You need Hybrid Identity Administrator rights in the tenant and a domain admin account that is not in Protected Users. Run Update-AzureADSSOForest once per forest; running it twice breaks sign-in until users' Kerberos tickets expire.

    cd "$env:ProgramFiles\Microsoft Azure Active Directory Connect"
Import-Module .\AzureADSSO.psd1
New-AzureADSSOAuthenticationContext
Get-AzureADSSOStatus | ConvertFrom-Json   # read-only: forests using it
$creds = Get-Credential                    # CORP\domainadmin
Update-AzureADSSOForest -OnPremCredentials $creds

  3. Schedule it at least every 30 days.

  4. If Seamless SSO is not needed, disable it in Entra Connect (Change user sign-in) and delete the AZUREADSSOACC$ account afterwards, as the FAQ describes.

  5. Treat the account as tier 0: only tier-0 admins should be able to read its keys or change it.

Verify

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-KRB-006

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-KRB-006"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References

Microsoft and vendors

Research

MITRE ATT&CK

Available since 0.1.0.