What is a secure way to log onto the domain controller?

Question

On a pentest we found that a kerberos ticket under account name administrator was cached on one of the SQL database servers, which allowed us to steal the ticket, pass-the-ticket and log onto the domain controller. The logon type was remoteinteractive which suggests that a user from SQLDB01 made a RDP session to DC01. In terms of recommendations, I believe restricted admin mode does not protect against this attack as this protection just forces kerberos ticket to default.

1. What other recommendations are there?
2. Use credential guard to protect against dumping of kerberos tickets (?)
3. What is the correct/secure way to log onto the DC? I assume a jumpbox?

Answer 1

As your explanation, It is looks like a common issue in kerberos. It is call golden ticket attack.

You can take following step to mitigate risk of this vulnerability.

1. Use Least privilege mode
2. Limit Administrator access.
3. Use Administrator Account for Limited and required changes only.
4. Use End-point protection to mitigate attacks
5. Adding Additional Layer of Security to domain Controller. - You can configure terminal server and allow access to dc only from that particular server.
6. Based on Requirement you can decide kerberos ticket life time.
7. Server hardening with appropriate security policies , patches...etc.
8. Use Detection tool for further security.
9. Configure Host firewall such as windows Firewall.
10. Block internet access and internet browsing from Domain controllers.
11. Use Secured Domain management to avoid login to DC.

Answer 2

From explanation it looks like a normal case of using a single administrator user credentials for all infrastructure which most of the people do to avoid inconvenience.

If you see the problem here, it's very simple to understand that an administrator account of Domain Controller was used to access an SQL Database server and for which you were able to extract the ticket. Now when it comes to recommendations I'd advise as follows.

These are general recommendations which should be taken care by every administrator.

1. Use of Local Administrator Account should be preferred instead of Domain Administration Account's password being sprinkled everywhere. If somebody can do this for every server they would save themselves from such incidents.

2. All the servers (at the minimum) should be set to "Not Cache Credentials" This can be done from Computer Configuration\Windows Settings\ Security Settings\Local Polices\Security Options\Interactive Logon: Number of previous logons to cache. Set it to 0.

The problem with point 2 would be that if AD isn't available users might not be able to login. So here is a bit of trade off that should be considered.

3. Administrators should use separate accounts for their administrative tasks.

What other recommendations are there?

I have shared above.

Use credential guard to protect against dumping of kerberos tickets

Yes this should be used and It is also recommended to have a proper SIEM tool and configured in a way to detect such attempts so proper actions can be taken in time.

What is the correct/secure way to log onto the DC? I assume a jumpbox?

Follow the above recommendations and Jumpbox is one additional layer that can be used.