Credential Harvesting from Network Access Accounts

On a Microsoft Configuration Manager client, a local administrator can use SharpSCCM to retrieve policy-stored Network Access Account secrets from the local WMI repository and decrypt their DPAPI-protected blobs. Recovered NAA credentials can authenticate to distribution-point content or other resources within the account's configured permissions. The result depends on the client having received an NAA policy and the account remaining valid.