Private Access sensors are enforcing strong authentication policies on domain controllers

Overview

If you don’t deploy Microsoft Entra Private Access sensors to domain controllers, threat actors can exploit Kerberos authentication requests from any device on the network, including unmanaged or compromised endpoints. They can use this vulnerability to get service tickets for on-premises resources without multifactor authentication or device compliance validation.

If you don’t deploy Private Access sensors to domain controllers:

• Threat actors can request Kerberos tickets for privileged resources such as file shares, database servers, and remote desktop services. This vulnerability enables lateral movement across the on-premises environment.
• Conditional Access policies don’t apply to Kerberos authentication, because it operates within a perimeter-based trust model where any authenticated user can request tickets regardless of authentication strength or device posture.
• Compromised user credentials obtained through phishing or credential theft can be immediately used to access domain-authenticated resources without triggering multifactor authentication requirements.

Remediation

• Configure Microsoft Entra Private Access for Active Directory domain controllers.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Medium
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Authentication
ATT&CK	T1558 Steal or Forge Kerberos Tickets, T1078.002 Domain Accounts
Licence	Entra_Premium_Private_Access, Entra_Suite
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.