The (Un)Rightful Heir: My dMSA Is Your New Domain Admin

The talk looks at delegated managed service accounts (dMSA), a feature Microsoft added to Active Directory in 2025 to replace legacy service accounts. The speaker explains why legacy accounts remain common: some services cannot use managed accounts, and migrating existing ones is laborious. Microsoft's dMSA migration promises to move a legacy account with little effort, but its documentation says nothing about how group privileges carry over.

The speaker walks through how a migration links the new account to the old one, and how the domain controller merges the group memberships of both accounts into the ticket. That merge means a dMSA can inherit another account's privileges. Starting a migration normally requires domain admin rights, but the underlying attribute changes can be made by anyone who controls a dMSA. A dMSA can also be created in any organizational unit where a low-privileged user has rights. In a demo, a weak user created a dMSA, linked it to the Administrator account, authenticated as it, and added members to Domain Admins. The speaker also found that the previous keys field exposed the linked account's password hash, which allowed credential dumping, including the krbtgt account.

Microsoft accepted the report as a vulnerability but rated it moderate and said a fix is planned. For defenders, the speaker recommended auditing dMSA creation and linking with a system ACL, and watching for TGT requests logged with blank caller details. The main takeaway is to monitor dMSA creation and link events now, while waiting for the patch.