The Nessus vulnerability scanner from Tenable is a widely known tool for conducting vulnerability assessments of networks and devices, such as workstations, network gear, and servers. While Tenable does have a separate Active Directory security product called Tenable.ad, one capability of Nessus (as well as their enterprise solution Tenable.io) that is very rarely talked about is scanning the Active Directory configuration for vulnerabilities.

Vulnerability Coverage

Included in Nessus is a scan template called “Active Directory Starter Scan”. For some reason, it is difficult to find detailed information on this template, however, according to a blog post from Tenable, this scan runs the following ten checks on your Active Directory configuration:

  1. Kerberoasting: A Domain admin or Enterprise admin account is vulnerable to the Kerberoasting attack
  2. Weak Kerberos encryption: The Kerberos encryption is too weak on one user account leading to potential credential theft
  3. Kerberos pre-authentication validation: The Kerberos pre-authentication is disabled on one user account leading to potential credential theft
  4. Non-expiring account password: A user account may never renew its password.
  5. Unconstrained delegation: Unconstrained delegation is allowed on a computer account allowing potential credential theft
  6. Null sessions: The Anonymous or Everyone group is part of the “Pre-Windows 2000 Compatible Access” allowing null session attacks
  7. Kerberos KRBTGT: The Kerberos master key is too old and could be used as a backdoor
  8. Dangerous trust relationship: No security mechanism has been activated on a trust relationship allowing lateral movement across AD domains
  9. Primary Group ID integrity: A potential backdoor using the Group ID has been found on a user account
  10. Blank passwords: A user account may use a blank password to authenticate on the domain

Creating Credentials

Before setting up an Active Directory Starter Scan with Nessus, you’ll need to provide Nessus with Domain Admin credentials in the form of ADSI. In order to do that, I recommend creating a service account for Nessus to use.

  1. I created a new user in Active Directory called “NessusScan”

https://miro.medium.com/max/1022/1*2sbv27TsBstmtwbCz7h20g.png

  1. Add the user account to the “Domain Admins” group

https://miro.medium.com/max/972/1*8wBY78mgWRgB0kwbK5OP4w.png

Configure Scan