A city still has legacy Windows hosts domain-joined with weak local controls. How should the tester treat them in an AD path assessment?
Select an answer to reveal the explanation.
Short Explanation
Old, soft workstations are the unlocked side doors into a modern office. Once inside, stolen creds and sessions open directory paths. Do not pretend only domain controllers count.
Full Explanation
Weak legacy Windows hosts that remain domain-joined often become credential-harvest footholds that start Active Directory compromise paths. A city that still runs such endpoints with weak local controls gives assessors (and adversaries) places to steal hashes, tickets, or reusable local admin secrets that then feed lateral movement into stronger tiers supporting public services.
Domain-joined legacy hosts do participate in Kerberos authentication by design when joined correctly—claiming they cannot is false. Legacy workstations are not out of scope for AD findings merely because DCs are the crown jewels; footholds matter. Weak endpoints do not reduce AD risk by “isolating” users; they usually increase harvest surface.
Exam caveat: include legacy estate hygiene in AD path assessments even when the final objective is a DC or file server. CPTS reporting should show foothold → credential → path without requiring out-of-scope exploitation.
Operational check: inventory domain-joined legacy OS versions, prioritize isolation or upgrade, enforce LAPS and EDR where possible, and re-evaluate whether civic AD paths still begin on those hosts after remediation. Budget modernization of those legacy civic endpoints alongside AD hardening so foothold economics change for both testers and real adversaries.