9.6.6 Conditional AD infrastructure and trust checks

Stage index | Complete task index | Object control and delegation | Check which other hosts your current identity can access

Use these checks when host or directory evidence identifies the feature. They identify the next prerequisite to investigate; they are not complete exploitation recipes for every product or version.

9.6.6.1 DNSAdmins: distinguish DNS configuration from a service trigger

# Domain-joined source with the RSAT AD module and readable group membership
Get-ADGroupMember -Identity DnsAdmins -Recursive

:: Service queries use the current identity and can be denied separately
sc.exe \\DC_HOST qc DNS
sc.exe \\DC_HOST sdshow DNS

Read → next: resolve whether the controlled identity really has DNS-server configuration rights, which server runs DNS, its service identity, and whether a usable plugin/configuration operation and restart trigger exist on that build. Group membership alone does not prove immediate execution or restart rights. Follow the service-control permission workflow. A DNS restart on a DC can interrupt the domain; do not use it as a discovery probe.

9.6.6.2 WSUS: identify the update authority from the current client

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v WUServer
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v WUStatusServer
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v UseWUServer

Read → next: record the actual server URL, port, TLS and client policy. A client configured for WSUS does not grant update approval, content/signing control or server administration. Investigate server access and the exact privileged update consumer only after those rights are established. Missing registry values can mean another policy/configuration source; they do not prove the organization has no WSUS.

9.6.6.3 Configuration Manager / SCCM: recognize the client before choosing a server-side path

Get-Service CcmExec -ErrorAction SilentlyContinue
Get-CimInstance -Namespace root\ccm -ClassName SMS_Client

Read → next: CcmExec/SMS_Client identifies a client context. It does not prove site-server access, SMS Provider authorization, deployment rights, accessible network-access-account credentials or permission to execute CMPivot. Record the site/management point from readable client configuration and test only the matching authenticated interface. Namespace absent and access denied are different outcomes. This reference does not yet contain a complete SCCM compromise procedure.

9.6.6.4 Trusts: inspect the boundary before treating another domain as reachable privilege

nltest /domain_trusts /all_trusts

# RSAT alternative; query the domain in the current authenticated context
Get-ADTrust -Filter * -Properties * |
    Format-List Name,Direction,TrustType,ForestTransitive,SelectiveAuthentication,SIDFilteringForestAware,SIDFilteringQuarantined

Read → next: keep trust direction, same-forest versus cross-forest scope, SID filtering, selective authentication, target SPN and the accepted identity separate. A trust object or child-domain admin does not by itself prove a usable forest-compromise chain. Verify name resolution, service reachability and authorization in the destination using the movement preflight. Trust-key/SID-history forgery and cross-forest coercion are specialized paths, not complete procedures in this playbook.