Managed Service Accounts Dangerous Misconfigurations

MSAs (Managed Service Accounts) provide a secure way to manage Active Directory service accounts. A MSA has its own complex password which is maintained automatically, as computer accounts do. This feature should be deployed and correctly configured so that no illegitimate user account can compromise them (e.g. through "Kerberoasting" attacks)

Service accounts should be configured as Managed Service Accounts (MSAs) and secured properly, to avoid potential elevation of privileges and persistence mechanisms.

Name: Managed Service Accounts Dangerous Misconfigurations

Codename: C-MSA-COMPLIANCE

Severity: High