Golden dMSA Flaw Exposes Firms to Major Credential Theft

A critical cryptographic flaw in Windows Server 2025’s delegated Managed Service Accounts, or dMSAs, allows attackers to generate passwords for every managed service account across an Active Directory forest and create a backdoor, researchers reported.

See Also: On Demand | Ransomware in 2025: Evolving Threats, Exploited Vulnerabilities, and a Unified Defense Strategy

“The Golden dMSA attack leverages a cryptographic vulnerability that can undermine Microsoft’s latest security innovation in Windows Server 2025,” Semperis researchers said in a report. “This technique exploits the architectural foundation of delegated Managed Service Accounts.”

The Golden dMSA technique bypasses Microsoft’s intended security model by abusing predictable time-based components in the ManagedPasswordId structure. “The attack leverages a critical design flaw: the ManagedPasswordId structure contains predictable time-based components with only 1,024 possible combinations, making brute-force password generation computationally trivial.”

With access to the KDS root key, an attacker can generate valid credentials for dMSAs and gMSAs, bypassing traditional protections. “This means a single successful KDS root key extraction transforms into cross-domain account compromise. No domain boundaries can stop us. Forest-wide credential harvesting. Every dMSA in every domain becomes vulnerable. Unlimited lateral movement. We can jump between domains at will using compromised dMSA accounts. Persistent access. With no expiration on KDS keys, this access could last indefinitely.”

Wade Ellery, chief evangelist and IAM strategy officer at Radiant Logic, said that the discovery highlights the broader risks of centralized identity architecture. “Efforts to provide interoperability and streamlined management across IT resources is a positive direction, but with it comes increased vulnerability to single points of compromise that can lead to catastrophic risk,” he said.

Microsoft acknowledged the report but said the feature was never designed to defend against a domain controller breach. “If you have the secrets used to derive the key, you can authenticate as that user. These features have never been intended to protect against a compromise of a domain controller,” the company said in its July 8 response to Semperis.

The risk is compounded by the indefinite lifespan of KDS root keys. “KDS root keys have no expiration date,” Semperis said. “Even in environments with multiple KDS root keys, the system consistently uses the first KDS root key for compatibility reasons. This means that original key we’ve compromised could be preserved by Microsoft’s design, creating a persistent backdoor that could last for years.”

Ellery said that organizations need to focus on stronger governance: “Organizations need to treat these keys like the crown jewels, applying strict privilege governance, layered monitoring and zero trust principles to limit the damage of a worst-case scenario.”

Microsoft also disclosed that some protections have been temporarily suspended. “Starting with the April Windows security update KB5055523, Credential Guard protected machine accounts is temporarily disabled in Windows Server 2025 and Windows 11, version 24H2,” the company said. “This feature has been disabled due to an issue with machine password rotation using Kerberos.”

Golden dMSA also evades existing defensive tools. “Detection of Golden dMSA activity requires manual log configuration and auditing, making mitigation difficult,” Semperis researchers said. “By default, no security events are logged when a KDS root key is compromised.”