What Failover Clusters Are and Why Attackers Should Care

▶ Watch (01:45)

Windows Server Failover Clustering ships as a set of independent servers sharing a virtual identity so that file servers and databases stay online if one node fails. Microsoft introduced it in 1997 with Windows NT 4.0 Enterprise Edition. The research started when SpecterOps operators ran a standard WriteAccountRestrictions/RBCD attack, got payload execution, but saw it land on a completely different host. Inspecting the SPNs on the target revealed failover cluster entries rather than a DNS alias. That anomaly is what opened the investigation.

Why Kerberos Tickets Work Across Cluster Nodes

▶ Watch (15:11)

Each cluster carries two AD machine accounts: the Cluster Name Object (CNO) for administration and a Virtual Cluster Object (VCO) for each hosted role. Only one physical node owns each account at a time, but ownership shifts on failover. So why does a service ticket issued against the VCO still decrypt on a different node? Every node holds the current and previous passwords for both accounts in its LSA. The cluster service logs on to them at startup so any node can take over without re-authenticating.

Decrypting Cluster Credentials from the Registry

▶ Watch (18:41)

CNO and VCO passwords sit in an encrypted registry blob under the resource-data key, present on every node. Evan McBroom (author of LSA Whisperer) reverse-engineered the cluster service with private symbols, found the decrypt class, and traced the proc monitor trace of password rotation (19:35): query a crypto-container GUID, follow it to a CSP private key, decrypt the embedded secret, derive the AES key for the blob. The blob stores the current password and the previous one, matching the krbtgt model so sessions survive rotation. The finished tool outputs RC4 NT hashes for both accounts.

Owning Every Node with One Ticket

▶ Watch (24:57)

With the VCO hash, an attacker runs S4U-self to forge a ticket as any user against the cluster, then connects to the cluster RPC API as a cluster admin. The S4U-self payload execution across all three nodes (25:38) demonstrated the sequence: schedule a task on the current owner, move the role to the next node, run the same task without reissuing the ticket, repeat. One ticket. Three callbacks.

“if you own the node, you own the cluster” — Garrett Foster

Protected Users and “account cannot be delegated” do not block S4U-self, so there is no per-account mitigation available.

CNO Permissions and the Path to Domain Compromise

▶ Watch (31:28)

CNOs only need “create computer objects” on an OU, but deployment guides routinely instruct admins to grant generic-all or full control. Foster showed attack graphs from real enterprise environments where CNO control led directly to DC-sync, including a chain through an Entra-synced identity from on-prem to cloud and back. A BloodHound Enterprise query across SpecterOps tenants found clusters in 82% of environments, 141 unique clusters on average, and one tenant with 2,700. The surface includes MSSQL always-on groups, Exchange database availability groups, ADCS, and SCCM.

“clustering is older than active directory itself” — Garrett Foster

Detection and Remediation

▶ Watch (34:21)

Two controls address most of the exposure. First, audit every CNO and VCO in Active Directory and pull permissions back to “create computer objects only.” That is the minimum the cluster actually needs. Second, add a SACL to the resource-data registry key on each node. Only the cluster service and its child process (resource control monitor) legitimately read that key. Any other principal reading it is a high-fidelity signal of credential theft. On the detection side, CNO and VCO accounts should only authenticate from known cluster node IPs. A logon from any other source address warrants immediate investigation.

Q&A

Do you have BloodHound queries to find clustered resources in an environment? Yes, the queries will be published in the blog, and Foster is also working on extending BloodHound’s collection methods to streamline cluster discovery. ▶ 38:00

Notable Quotes

if you own the node, you own the cluster Garrett Foster · ▶ 36:02

clustering is older than active directory itself Garrett Foster · ▶ 36:34

it was in 82% of the environments that that we have access to Garrett Foster · ▶ 33:55

Key Takeaways

  • Every cluster node holds the CNO and VCO passwords in its LSA — owning one node gives you all of them.
  • CNOs are routinely granted generic-all or full-control on OUs, turning cluster access into DC-sync in 82% of surveyed environments.
  • Defenders can SACL the cluster resource-data registry key and alert on logons from unexpected source IPs.