Skip to content

BadSuccessor (dMSA Abuse)

With the correct permissions, mimic a legitimate Delegated Managed Service Account (dMSA) and escalate privileges.

Requirements

  • Account with Create all child objects or msDS-DelegatedManagedServiceAccount permissions on an organizational unit (OU).
  • Windows Server 2025 DC. dMSA was introduced in 2025. Unpatched as of 9/11/25.

How it works

  • Normal dMSAs have the following attributes after being set as a dMSA:
    • msDS-ManagedAccountPrecededByLink: <account being delegated>
    • msDS-DelegatedMSAState: 2 - 2 indicates the dMSA process is complete.

If an attacker has an account with the permissions to create an account and set these values on it, they can mimic a legitimate dMSA and escalate privileges to any user in the domain.

References