Adaxes service account -> Managed Service Account?

Question

Hello,

with Server 2008R2 Microsoft introduced the managed service accounts. This is a very valuable feature since it reduces the risks in pass-the-hash attacks.

Can the adaxes service user be configured as a managed service account?

Thank you for your help!
HarryNew

Answer 1

Hello Harry,

No, there is no such possibility.

Comments

Hello,

thank you for your answer.

This is a major drawback . Are there any plans for implementing the managed service accounts? Using long-term passwords and hashes in a Microsoft environment is not very secure and, considering the permissions the adaxes service account has in Active Directory, poses a serious security threat. Cycling the password regularly would lower this risk considerably.

Regards
HarryNew

---

Hello Harry,

Are there any plans for implementing the managed service accounts?

Currently, there is no technical possibility to implement the feature. In such cases, Microsoft recommends using 20+ characters long passwords.

considering the permissions the adaxes service account has in Active Directory, poses a serious security threat

The Adaxes service account (specified during Adaxes installation) needs only the permissions to publish and unpublish Adaxes service in Active Directory (create/delete a Service Connection Point). No other permissions are required. For details on how to grant the permissions, see https://www.adaxes.com/resources/releas ... ishservice.

---

Hello,

thank you for your answer.

Unfortunately I don't completely understand what you are saying. Maybe there are two service accounts that we need to look at. We originally installed Adaxes together with a business partner. I remember that there was a discussion about the fact that the adaxes service account should be a domain administrator. This violates our security guidelines. Therefore we chose to just give the adaxes service account the minimum permissions needed to perform it's operations in AD. But if you are saying that the service account does not need specific permissions in AD then how does adaxes go about performing the configured tasks in AD?

Regards
HarryNew

---

Hello Harry,

As it was stated in our previous post, the Adaxes service account needs only the permissions to publish and unpublish Adaxes service in Active Directory. All operations in a managed domain are performed using the credentials of the account that was specified during the domain registration in Adaxes. For information on how to change the account, see https://www.adaxes.com/help/?HowDoI.Man ... nInfo.html.

---

Hello,

thank you for the information and the links.

Can we use a "managed service account" for the "Service Account for Managed Domain"? Since this is the account that has the permissions in active directory it would be the one that we would like to protect.

Regards
HarryNew

---

Hello,

No, there is no such possibility, same as for the Adaxes service account.

---

Hello,

thank you for your answers and insights.

We are currently still running Adaxes 2017.2 since we had some problems with 2018.1. Do the above statements about the two different service accounts and their roles and permissions also apply to 2017.2?

Regards
HarryNew

---

Hello Harry,

Yes, the statements are valid for Adaxes 2017.2, Adaxes 2018.1 and the latest Adaxes 2018.2.