AI
Kerberoasting and the MSA Adoption Problem
Legacy service accounts have run Active Directory environments for decades. Their biggest security risk is kerberoasting: attackers request a service ticket, then crack the account’s password offline. Microsoft introduced Managed Service Accounts in 2008 and Group Managed Service Accounts in 2012 to eliminate that risk with auto-rotating passwords. Adoption stalled for two reasons: many services don’t support MSA natively, and migrating an existing service requires IT effort where any mistake risks downtime. For critical services, that risk is unacceptable.
What DMSA Adds: Automated Zero-Touch Migration
DMSA (delegated Managed Service Account) arrived in 2025 with an automated three-phase migration process: start, wait, then complete. During the waiting phase, the Kerberos client on each server automatically sends an LDAP modification to the DC, granting that server permission to authenticate as the DMSA later. When migration completes, the legacy account is disabled and all services switch to the DMSA automatically, regardless of whether they natively support MSA. No service reconfiguration. No downtime risk.
PAC Merging: Privilege Inheritance Without Group Changes
Kerberos tickets carry a PAC (Privilege Attribute Certificate) listing every group the account belongs to. A freshly created DMSA has no group memberships, so its PAC would be empty, and any service running under it would fail. Gordon found Microsoft’s solution is a PAC merge. When the DC issues a TGT for a DMSA linked to another account, it generates a PAC for each account separately, then merges them. The result carries the full group membership of the superseded account, preserving its domain privileges exactly.
Bad Successor: OU Write Access Becomes Domain Admin
Starting a migration requires a PowerShell cmdlet that wraps an LDAP operation, which the DC checks for domain admin rights. Gordon found the underlying operation just writes attributes on the DMSA and the linked account. Writing those attributes directly works without domain admin rights. An attacker with write access to any OU can create a DMSA there, set the link attribute to point at a domain admin, then authenticate as the DMSA. The DC issues a merged TGT with full domain admin privileges. In the demo, the attacker went from zero to domain admin in seconds.
Credential Hashes Follow the Privilege Merge
After running Bad Successor, Gordon noticed the DMSA’s TGT response contained a KB-DMSA-KEY-PACKAGE structure with two fields: current keys and previous keys. Current keys held the DMSA’s own Kerberos credentials. Previous keys held the NT hash of the administrator account Gordon had linked, even though the DMSA was newly created and had no prior password. Linking a DMSA copies not just privileges but also the target account’s Kerberos keys. A script can dump credentials for every user and computer in the domain, including krbtgt.
Detecting Bad Successor Before a Patch Arrives
Three log sources help catch this attack. First, configure a SACL on any OU where DMSAs might be created to generate events when new DMSA objects appear. Second, add a SACL on the link attribute so any write triggers a log entry. Third, watch the GMSA password fetch log. Gordon found that DMSA authentication triggers this log with the caller SID set to anonymous logon and a blank caller IP. Microsoft rated the vulnerability moderate severity and confirmed a future fix is in progress.
Notable Quotes
one solution which is fusion. Yuval Gordon · ▶ 16:42
what’s the worst that can happen right? Yuval Gordon · ▶ 23:20
um seems quite moderate. Yuval Gordon · ▶ 29:08
Key Takeaways
- Write access to any Active Directory OU is enough to compromise the entire domain via Bad Successor.
- The DMSA PAC merge copies a linked account’s privileges without changing group memberships, a novel AD mechanism.
- Linking a DMSA also delivers the target account’s Kerberos credential hashes, enabling domain-wide credential dumping.
- Enable SACL logging on DMSA creation and link attributes; watch for anonymous logon in GMSA password fetch events.
- Microsoft confirmed a future fix; DMSA’s migration model is worth adopting once the vulnerability is patched.
About the Speaker(s)
Yuval Gordon is a Security Researcher at Akamai Technologies, specializing in Active Directory security and identity-based attacks. His research is focused on offensive security, malware analysis, and threat hunting.