Golden dMSA: A Critical Zero‑Click Persistence Exploit in Windows Server 2025

What Is Golden dMSA?

On July 16, 2025, Semperis researcher Adi Malyanker disclosed Golden dMSA, a critical design flaw in delegated Managed Service Accounts (dMSAs) introduced with Windows Server 2025. The vulnerability allows attackers to generate service account passwords offline using brute-force methods, compromising all dMSAs and gMSAs in the domain.

This flaw arises from predictable elements in the ManagedPasswordId structure, which attackers can easily guess, enabling the offline creation of service account credentials without any domain controller interaction.

Why It Matters

• Low complexity, high impact: The ManagedPasswordId structure uses a weak time-based component with only 1,024 possible values, making brute-forcing trivial.
• Stealthy, persistent access: Attackers who obtain the Key Distribution Service (KDS) root key can maintain access to service accounts and move laterally undetected.
• Forest-wide risk: A breach in one domain potentially grants access across the entire Active Directory forest.
• Bypasses modern defenses: Even protections like Credential Guard and tiered admin models are insufficient against this cryptographic weakness.

Golden dMSA introduces an identity-level risk where traditional network- or memory-based detection may not apply, demanding stronger emphasis on cryptographic hygiene and privilege limitation.

How It Works (Attack Flow)

1. KDS root key extraction – Attackers with Domain Admin or SYSTEM privileges extract the KDS root key from a domain controller.
2. Enumerating dMSAs – Attackers list service accounts and their associated SIDs using LDAP queries or API enumeration.
3. Brute-forcing ManagedPasswordId – They cycle through all 1,024 possible time-based IDs to identify the correct one.
4. Offline password generation – Using the root key and correct ID, attackers generate valid service account passwords offline and use them for authentication.

This technique enables full access to systems using these accounts, with no need to contact the domain controller during login.

Semperis & Industry Response

• Proof-of-concept tool: Semperis released “GoldenDMSA,” enabling organizations to test exposure in lab environments.
• Risk rating: Rated “moderate” due to requiring Domain Admin access, but the impact is severe due to stealth, scope, and persistence.
• Detection: Semperis and Akamai updated their Directory Services Protector (DSP) tools with indicators for modified KDS ACLs and suspicious dMSA patterns.
• Community collaboration: Microsoft has acknowledged the flaw and is working with security partners to evaluate fixes and issue mitigation guidance.

Implications for AD Security

The attack underscores that even innovative identity features like dMSAs must be designed with cryptographic robustness. Trusting the internal logic of systems like the KDS can lead to major blind spots.

Mitigation Strategies

• Monitor KDS ACL changes – Look for unauthorized modifications or unexpected access changes.
• Audit dMSA usage – Implement detailed logging for LDAP queries and service account authentications.
• Apply DSP tooling – Use updated detectors from Semperis and Akamai to flag misuse of dMSAs.
• Enforce least privilege – Restrict Domain Admin and SYSTEM privileges tightly; use tiered admin models.
• Isolate KDS functions – Consider operational separation or hardening of the Key Distribution Services.
• Test with GoldenDMSA – Validate your AD environment’s exposure in a secure, simulated environment.

Conclusion

Golden dMSA is a clear reminder that design matters in identity security. While Windows Server 2025 aimed to improve service account security, it inadvertently introduced a stealthy attack vector that allows long-term, undetectable persistence.

Organizations must rethink trust boundaries, apply strict cryptographic standards, and implement real-time monitoring. Most importantly, defenders must simulate and anticipate identity-based threats—not just rely on perimeter protections.

With the rise of delegated and automated service accounts, security teams need to stay ahead of novel attack surfaces like Golden dMSA before adversaries exploit them.

References

• The Hacker News – Critical Golden dMSA Attack in Windows Server 2025 Allows AD Persistence
• SecurityBrief Australia – Windows Server 2025 flaw lets attackers persist in Active Directory
• Semperis – Golden dMSA: What is dMSA Authentication Bypass?
• PR Newswire – Semperis Research Uncovers Critical Flaw in Windows Server 2025