Credential Dumping: gMSA

“In Active Directory, ReadGMSAPassword should only be granted to specific systems. If these permissions are misconfigured, an attacker with access to a machine that can query the gMSA password can extract it and use it to authenticate as that service account.”

Microsoft shipped Group Managed Service Accounts in Windows Server 2012 to kill a specific bad habit: service accounts with a static password that had not changed since the server was racked. On paper it works — the password is machine-generated, long, and rotates automatically, so nobody can crack it and nobody has to remember it. Credential Dumping: gMSA is about the gap that logic leaves open: the cryptography is fine, but the question of who is allowed to ask for the password is an ACL, and ACLs rot.

Understanding the Paradigm Shift

The guide explains what gMSAs actually buy you: AD generates a complex password, roughly 240 bytes of it, and rotates it on a schedule with no human in the loop, which takes Kerberoasting off the table for those accounts.

So the attacker does not attack the password — there is nothing there to crack. The attack is the ReadGMSAPassword right. The premise is almost mundane: find a security group that has been granted permission to read the managed password blob, compromise a member of it, and ask AD for the blob over the network. It hands it over, because that account is authorised to receive it.

The Exploitation Chain

The text runs a realistic red-team sequence from discovery to compromise:

• Hunting via BloodHound: Using the graph to find the privileged gMSAs and the low-value accounts that, through group nesting nobody audited, hold ReadGMSAPassword over them.
• Targeted Extraction: gMSADumper, Impacket, and NetExec reading the msDS-ManagedPassword blob and deriving the NT hash from it.
• Execution & Lateral Movement: Taking that hash into a Pass-the-Hash or Overpass-the-Hash to authenticate as the service.

Who Is This Book REALLY For?

• Red Team Operators: A prompt to stop tunnel-visioning on NTDS.dit and hunt over-privileged gMSA read groups, which are frequently an easier and quieter path.
• Active Directory Security Architects: The blunt lesson that a strong control granted to a broad, unmanaged group is not a control. Scope ReadGMSAPassword to the specific hosts that run the service, and nothing else.
• SOC Analysts: Understanding how the tools query msDS-ManagedPassword is what lets you write an LDAP-access alert that fires on the read rather than on a tool name.

The Bottom Line

Credential Dumping: gMSA lands on a durable truth: a secure feature guarded by a broken access control is not secure. It is a clear guide to the modern evolution of service-account abuse — and a reason to go check who can read your gMSAs today.