Domain controller RDP access is protected by phishing-resistant authentication through Global Secure Access

Overview

When administrators use Microsoft Entra Private Access to reach domain controllers through Remote Desktop Protocol (RDP), they authenticate through Microsoft Entra ID before the Global Secure Access client tunnels their connection to the on-premises network. Domain controllers hold the cryptographic keys to the entire Active Directory forest. Compromising one domain controller offers a way to compromise every identity and resource in the organization.

Without phishing-resistant authentication:

• Threat actors can intercept credentials during phishing campaigns or adversary-in-the-middle attacks.
• Stolen session tokens can be replayed to establish RDP connections to domain controllers.
• Once connected, threat actors can execute DCSync attacks to harvest all password hashes in the domain.
• Attackers can create golden tickets for indefinite domain persistence.
• Group Policy Objects can be modified to deploy ransomware or backdoors across all domain-joined machines.

By requiring phishing-resistant authentication, organizations ensure that even if users are successfully phished, threat actors can’t replay credentials because these methods require cryptographic proof of possession.

Remediation

• Deploy phishing-resistant authentication methods to domain controller administrators.
• Require phishing-resistant authentication for administrators accessing domain controllers via RDP.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Conditional Access
Area	Privileged access
ATT&CK	T1021.001 Remote Desktop Protocol, T1557 Adversary-in-the-Middle, T1078.002 Domain Accounts
Licence	Entra_Premium_Private_Access, AAD_PREMIUM
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.