H3-2023-0003
Pre-Windows 2000 Computer Set
| Category | SECURITY_MISCONFIGURATION |
| Base Score | 9.8 |
Description
Windows Active Directory supports pre-creating a machine to be joined to the domain by creating a computer account where the password is the same as the computer name. Additionally, if a machine account is reset and becomes out of sync with the domain, the domain controller will set the computer password to the computer name.
Impact
An attacker can discover Pre-2K computer accounts by spraying all the computer names as the password. Once the attacker is successful in identifying one, they can reset its password and gain control of the account.