What are the risks posed by "pass-through authentication" and how are they mitigated?

Question

Related:
Local Admin has Domain Admin rights

"Pass-through authentication" on Windows systems allows for the possibility for user accounts with the same name and password to impersonate one another, even though they may not be intended to have the same privileges.

Example:

Say we have a standalone PC, not joined to any domain. The PC is called MyPC, and it has an account called MyAdmin. The password for MyAdmin is, unoriginally, password.

Then we have a domain called MyDomain. The network administrator decided to call a Domain Administrator account MyAdmin and, in a demonstration of sheer incompetence, gave it a password of password.

For whatever reason, a completely unfiltered network connection exists between MyPC and all of the computers on MyDomain.

Any person who can log in to MyPC as MyPC\MyAdmin can exercise full Domain Administrator privileges on any system in MyDomain, as if they had actually logged in as MyDomain\MyAdmin, without being prompted to enter any additional credentials.

Intuitively, this seems wrong because (though they may have the same basic username & password) MyPC\MyAdmin and MyDomain\MyAdmin are two different user accounts, created in different scopes, with different permissions. However, what actual security risks does this pose? How can those risks be mitigated, or how are they already mitigated by design? Does the risk change if the "rogue" MyAdmin is a local account on a computer that is joined to the domain instead of just a random standalone system?

Answer 1

Here's the tricky part about the problem in your question: It doesn't exist. No no, I'm not being snarky. Hear me out.

You have a Domain administrator account with the password password (or any password of that sort), and the attacker created a local account with the same username and password. Without needing to create a local account, the attacker can simply user the username MyAdmin and the password password to login and use MyDomain\MyAdmin.

The problem has nothing to do with the pass-through authentication scheme, the problem is with using such passwords. Even if you, for example, disabled the whole functionality, the attacker can still use the username and password combination.

If it makes you sleep better at night, you can completely disable incoming NTLM authentication traffic by setting the following security policy in Group Policy \Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Incoming NTLM traffic to Deny all domain accounts.