Skip to content
attack.paths
Connexion
← RegistryDossier · 5 steps · 4 edges

MachineAccountQuota abuse → RBCD takeover of a server

Default ms-DS-MachineAccountQuota = 10 lets any authenticated user create a computer account, which can then be used as the source principal in an RBCD attack.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: ms-DS-MachineAccountQuota > 0 (default), attacker can write msDS-AllowedToActOnBehalfOfOtherIdentity on a target computer (via GenericWrite or GenericAll).

§ Steps

  1. 01
    Any authenticated userInitial Access
    T1078— Valid Accounts
  2. 02
    Write msDS-AllowedToActOnBehalfOfOtherIdentityLateral Movement
    AD-RBCD— Resource-Based Constrained Delegation (RBCD) Abuse
  3. 03
    S4U2self → S4U2proxy as AdministratorLateral Movement
    T1550.003— Pass the Ticket
  4. 04
    SMB exec on the target as AdministratorLateral Movement
    T1021.002— SMB/Windows Admin Shares
  5. 05
    Create attacker-owned computer$Initial Access
    AD-MAQ— MachineAccountQuota Abuse

    addcomputer.py -computer-name attacker$ -computer-pass <pw> <dom>/<user>:<pw>

§ References

§ Frequently asked

What is the "MachineAccountQuota abuse → RBCD takeover of a server" attack path?
Default ms-DS-MachineAccountQuota = 10 lets any authenticated user create a computer account, which can then be used as the source principal in an RBCD attack. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Any authenticated user (T1078) — a initial access primitive. Assumed environment: ms-DS-MachineAccountQuota > 0 (default), attacker can write msDS-AllowedToActOnBehalfOfOtherIdentity on a target computer (via GenericWrite or GenericAll).
What is the final impact of this kill-chain?
The final step lands on Create attacker-owned computer$ (AD-MAQ), which falls under Initial Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers