The November numbers

Every environment in the sample had at least one High finding. 94.8% had at least one Critical, up a little from 94.2% in October. The average environment had 42.4 findings and 18.7 of those were Quick Wins. That's about 44% of everything we found.

This Active Directory security benchmark only includes environments whose owners chose to share their results, so it doesn't represent every organization.

Work the Quick Wins alongside the Critical findings. They do the most for the least work and there are a lot of them. For the Criticals, start with anything that touches privileged access or certificate services.

Severity mix

High findings are still the biggest bucket at 15.7 per environment. That's more than four times the 3.5 Critical findings. The typical environment had about 3 Criticals. Moderate and Low are close to even at 11.5 and 11.8.

All four averages ticked up a little from October. Each one is rounded on its own, so together they add up to 42.5 instead of 42.4.

The most common findings

The top of the list is long-standing controls that most environments still skip. Kerberos protections and password hygiene make up most of it.

• Kerberos Armoring Not Enabled96.7%
• Accounts with Non-Expiring Passwords95.8%
• Protected Users Group Not Utilized95.7%
• Non-Expiring Passwords in Domain Admins Group91.5%
• Accounts With Stale Passwords88.2%
• Accidental Deletion Protection Not On OUs87.7%

Several of these come down to passwords that live too long. A non-expiring or stale password gives any old leak more time to be useful. That goes double for Domain Admins. Look at these findings together instead of one at a time.

Three more worth a look

These three didn't make the top six. All of them involve privileged accounts or Kerberos encryption.

What moved since October

Four findings moved a lot since October, measured in percentage points. Each month's Active Directory security benchmark uses a different set of environments, so a change can come from who scanned as much as from what got fixed.

ESC1 and ESC15 both climbed. If you run AD Certificate Services, look past the basic enrollment settings. Check who can enroll in each template and which templates let the requester supply the subject or use the certificate to sign in. Then make sure every CA has the November 2024 updates, which fixed ESC15.

Two moves went the right way. Stale krbtgt passwords dropped 21 points. Environments where non-admins can add computer accounts dropped 16. Our krbtgt reset guide and MachineAccountQuota post cover both fixes.

Spotlight: constrained delegation

Each Active Directory security benchmark digs into one finding. This month it's constrained delegation. Constrained delegation lets a service or computer account act as your users toward the services on its list. Lots of apps need it to work. If an attacker takes over one of those accounts, they can reach those services as other users. Accounts marked sensitive and members of Protected Users are the exceptions. A domain controller on the list makes it a lot worse.

The attacker's view

"Use Kerberos only" doesn't close every path. Take over an account trusted for constrained delegation and the services on its list come with it. Hunter Wade recently published a way to abuse "Use Kerberos only" on accounts with no SPN. That was the last setup without a public path. It needs RC4 plus a few other conditions to line up.

How bad it gets depends on what's on the list and what the account can already reach. Our constrained delegation guide covers the new path and how to clean it up.

Find constrained delegation in your domain

This lists every account with a delegation list or protocol transition turned on. Any domain user can run it.

Import-Module ActiveDirectory

# Accounts with delegation targets or protocol transition turned on
$filter = '(|(msDS-AllowedToDelegateTo=*)(userAccountControl:1.2.840.113556.1.4.803:=16777216))'
$props  = 'sAMAccountName', 'userAccountControl', 'msDS-AllowedToDelegateTo'

Get-ADObject -LDAPFilter $filter -Properties $props |
    Select-Object sAMAccountName, ObjectClass,
        @{ N = 'ProtocolTransition'; E = { [bool]($_.userAccountControl -band 0x1000000) } },
        @{ N = 'Targets'; E = { $_.'msDS-AllowedToDelegateTo' -join '; ' } }

Look at entries that reach a domain controller first. Then check any account where ProtocolTransition is True. Those can get a ticket as almost any user on their own. The script in our constrained delegation guide flags DC targets and accounts with no SPN for you.

Clean up constrained delegation

Find out which service owns each entry and where it really needs to delegate. Remove only the targets nobody needs. Test the app before and after, because some front ends really do depend on delegation.

Import-Module ActiveDirectory

# Computer account names end in $, such as 'APP01$'
$Account = 'svc-web'

# Each target to remove, exactly as the check above lists it
$Targets = 'HTTP/app01', 'HTTP/app01.example.com'

# Preview removing those targets. Drop -WhatIf to apply.
Get-ADObject -LDAPFilter "(sAMAccountName=$Account)" |
    Set-ADObject -Remove @{ 'msDS-AllowedToDelegateTo' = $Targets } -WhatIf

# Preview turning off protocol transition if the account doesn't need it
Set-ADAccountControl -Identity $Account -TrustedToAuthForDelegation $false -WhatIf

Run it with -WhatIf first. Once the preview shows only the targets you meant to remove, run it again without -WhatIf.

In Active Directory Users and Computers

1. Open dsa.msc and find the service or computer account.
2. Open its properties and go to the Delegation tab. Check each listed service and whether the app still needs it.
3. Once the change is approved, choose the Do not trust option if the account doesn't need delegation at all. Otherwise remove only the services it doesn't need.
4. Save and test the apps that depend on it, then rescan. An account with no SPN won't show a Delegation tab, so use the PowerShell above for those.

Compare your domain to this Active Directory security benchmark

Insight Recon runs the same 155+ checks behind this report against your domain. Line your results up with this month's numbers and you'll know where you stand. Every finding tells you how we'd abuse it on a pentest and how to fix it.

Active Directory security benchmark FAQ

References

• Hunter Wade, hun.io: Abusing Constrained Delegation without Protocol Transition against SPN-less accounts
• Microsoft Learn: Kerberos constrained delegation overview
• Microsoft Learn: Protected Users security group
• SpecterOps: Certified Pre-Owned, the original AD CS research behind ESC1
• TrustedSec: EKUwu, the research behind ESC15
• Microsoft Security Response Center: CVE-2024-49019
• Microsoft Learn: AD Forest Recovery, reset the krbtgt password
• Microsoft Learn: ms-DS-MachineAccountQuota attribute