ConfigMgr Client-Push Forced Authentication

Microsoft Configuration Manager (formerly SCCM) automatic client-push behavior can be abused, when the documented site and client-authentication prerequisites are met and the site server can reach a controlled destination, to make the primary site server authenticate via NTLM. SharpSCCM documents this registration and heartbeat path as causing the site to try configured client-push accounts and, if none can authenticate or none are configured, its domain computer account. The result is NTLM challenge-response material, not a reusable NT password hash. Cracking or relaying the response is a separate, protocol- and target-dependent action. This entry covers forced authentication only; the documented command does not relay the exchange to a second service. ATT&CK classifies the behavior as T1187 Forced Authentication.