When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password?


Computer Configuration / Windows Settings / Security Settings / Local Policies / User Rights Assignment

Deny log on locally: {service accounts' security group}

Deny log on through Terminal Services: {service accounts' security group}

The reason why I ask is this:

Because, unless you have a decent automated password management solution in place, resetting passwords for service accounts can be a huge task with the potential to cause service disruption, by denying interactive logons to service accounts, it is possible to configure them with passwords which do not expire, whilst ensuring an acceptable degree of security.

More specifically: What can a hacker do with credentials of such a service account if he gains also physical access to the same LAN where one of DC servers resides. Can he list records from the AD database like using this command?

dsquery user -name Vojt*
  • 1
    Depends a lot where the attacker is (Internet? Domain LAN/VPN but not domain joined? A low-privilege user on the same domain?) and what you expose to the relevant location (RPC endpoints? SSH server? Windows file shares?). There are lots of ways to interact with a Windows machine, with authentication, without technically performing an interactive login, although I'm not personally sure which APIs correspond to each log on "location".
    – CBHacking
    Aug 24 at 9:26
  • @CBHacking thanks, edited the question to be more specific. Aug 26 at 6:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.