Pre-Created Computer Account

Abuse an unused, pre-created Active Directory computer account whose legacy ‘Assign this computer account as a pre-Windows 2000 computer’ option was enabled. That option sets an initial password derived from the computer account name in lowercase, without the trailing ‘$’. If the account has not been joined to a computer and the password remains unchanged, the predictable credential may be known. A UserAccountControl value of 4128 can identify candidates, but does not prove that the legacy option was selected or that the password is still default. The account may need its password changed before it can be used for normal domain authentication.