AD-DMSALateral Movement

Delegated Managed Service Account Auth

Authenticate as a DMSA — Windows Server 2025 successor to gMSA with new attack surface.

§ Where this technique fits

AD-DMSA is catalogued under the Lateral Movement tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 4 on average.

§ Dossiers chaining this technique

BadSuccessor (DMSA, 2025) → instant Domain Admin
Server 2025's Delegated Managed Service Accounts inherit the powers of any account listed in msDS-ManagedAccountPrecededByLink — letting an OU-admin escalate to DA without any patch chain.
step 4 / 5

§ What commonly comes next

01
DCSync
T1003.006 · Credential Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

BadSuccessor (DMSA, 2025) → instant Domain Admin

§ What commonly comes next