Vulnerable Credential Roaming Related Attributes

"Credential roaming" is the mechanism that allows a user to access their secrets across computers on the domain. The Active Directory stores the credentials and protects them using a key derived from the user's password and a key stored in the ms-PKI-DPAPIMasterKeys attribute, which is encrypted with a secret backup key. However, if an unprivileged user controls these credentials and the backup key, the user's secrets become vulnerable.

An attacker who gains control over credential roaming attributes can decrypt and access potentially confidential information, or delete them to cause denial of service issues.

Name: Vulnerable Credential Roaming Related Attributes

Codename: C-CREDENTIAL-ROAMING

Severity: Low