#badsuccessor

[jsqforknowledge]

(2025-09-02) From BadSuccessor To PatchedSuccessor

Microsoft released Windows Server 2025 some time ago and one of the cool features is “delegated Managed Service Accounts (dMSA)”. With a dMSA, in general, you can migrate an existing (legacy) service account used for a service, scheduled task or application pool and have that dMSA do whatever that (legacy) service account is doing. In other words, the dMSA takes over the functionality of the…

View On WordPress

[jsqforknowledge]

(2025-07-11) How to Block BadSuccessor: The Good, Bad, and Ugly of dMSA Migration

This is a cross posting from the Semperis blog where this blog post was initially posted on 2025-07-10 and also written by me. The link to the Semperis blog post is: How to Block BadSuccessor: The Good, Bad, and Ugly of dMSA Migration ================================================================== Author: Jorge de Almeida Pinto, Semperis Senior Incident Response Lead Key…

View On WordPress

[jsqforknowledge]

(2025-05-25) Reviewing Your Delegation Model Before Introducing W2K25 DCs And Enhancing Security (Due To "BadSuccessor")

PS: the irony of this blog post about W2K25 DCs on may 25th of the year 2025 😉 Yuval Gordon, a security researcher at Akamai, wrote an awesome blog post about Delegated Managed Service Accounts (dMSA) and how that feature in an AD domain with at least 1 Windows Server 2025 RWDC could be misused. At its core the migration of a legacy service account to a dMSA could be misused for privilege…

View On WordPress