The UnRightful Heir: My dMSA Is Your New Domain Admin
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.
Summary
Delegated Managed Service Accounts in Windows Server 2025
Microsoft introduced delegated Managed Service Accounts (dMSAs) to simplify service account management, automate Kerberos SPN provisioning, and enhance enterprise credential hygiene.
Discovering Architectural Privilege Escalation Flaws
Yuval Gordon reveals fundamental design flaws in dMSA delegation inheritance and Kerberos ticket-granting routines in Active Directory environments running Windows Server 2025.
From Standard Domain User to Domain Admin
By manipulating dMSA object properties and exploiting Kerberos constrained delegation misconfigurations, unprivileged domain users can impersonate delegated service identities and escalate to Domain Admin.
Hardening Active Directory Identity Infrastructure
Securing dMSA deployments requires applying Microsoft directory patches, auditing dMSA creation permissions, and enforcing strict delegation boundary policies across Active Directory domains.
Related talks
Main Stage·39 min
Mehdi Elyassa
Explores new offensive attack paths and privilege escalation techniques targeting Microsoft System Center Configuration Manager (MECM/SCCM) in enterprise networks.
Main Stage·21 min
Antoine Goichot
Discloses subtle logic and authorization bypasses in Microsoft Windows Local Administrator Password Solution (LAPS) that enable credential theft.
Creator Stage·43 min
Brandon Colley
Walks through attack paths in the Game of Active Directory lab environment and demonstrates practical misconfiguration mitigations.