A critical design flaw in delegated Managed Service Accounts (dMSAs) introduced in Windows Server 2025

[ADMIN]

• The Golden dMSA attack enables attackers to bypass authentication and generate passwords for all dMSAs and gMSAs and their associated service accounts offline.
• Detection of Golden dMSA activity requires manual log configuration and auditing, making mitigation difficult.
• To exploit it, attackers must possess a KDS root key available only to only the most privileged accounts: root Domain Admins, Enterprise Admins, and SYSTEM.
• However, this attack can be high impact, enabling cross-domain lateral movement and persistent access to all managed service accounts and their resources indefinitely.

Tool: https://github.com/Semperis/GoldenDMSA