Machine Accounts in Active Directory: Hidden Risks of the Computer Object

In an Active Directory environment, a machine account (or computer account) is more than just a registry entry. It is a first-class citizen identity, complete with a unique security identifier (SID), a 128-character password rotated automatically by the domain, and an identity on the network that services trust as SYSTEM.

While we spend significant time monitoring user accounts, machine accounts are often the "shadow" identities that provide attackers with an easy path for privilege escalation.

What Makes Them Unique?

Machine accounts are easily spotted in AD by the trailing dollar sign ($) in their name (e.g., WKSTN01$). Because they are used for machine-to-machine authentication (like Kerberos or NTLM for file shares), they don't have human users to challenge for MFA. They are designed to be automated and silent.

The Attack Surface

Because these accounts operate with SYSTEM-level identity on their host, they are prime targets for several classes of AD attacks:

• Authentication Coercion: Using protocols like MS-EFSRPC (e.g., PetitPotam), attackers force a machine to authenticate to an attacker-controlled system, allowing for NTLM relaying.
• Shadow Credentials: If an attacker gains write permissions to a computer object in AD, they can populate the msDS-KeyCredentialLink attribute. This allows them to effectively "log in" as the machine without ever knowing the account password.
• The Machine Account Quota (MAQ): By default, AD allows any standard domain user to join up to 10 machines to the domain. An attacker can exploit this to create 10 machine accounts they fully control, providing them with a legitimate presence in the domain to start relaying or requesting certificates.

Defensive Hardening: Audit the MAQ

The easiest win for a defender is auditing the MachineAccountQuota.

Using NetExec, you can check your domain's policy in seconds:

nxc ldap <DC_IP> -u '<USER>' -p '<PASSWORD>' --maq

If the value is set to the default of 10, an attacker with valid user credentials can create accounts at will. Security best practice is to set this value to 0, effectively disabling the ability for non-privileged users to spawn their own machine objects in your domain.