Tracking down cached domain admin passwords

Question

This is for a smaller client of mine. They have a Hyper-V server hosting a domain controller and an apps server. Notably, the Hyper-V server is domain-joined.

We use a software that identifies and tracks changes in Active Directory (among other things) and I have been investigating an alert that the domain admin password has a large badPwdCount attribute. At the time of writing, the attribute is currently at 304.

We started rotating all admin passwords on a monthly basis and the alert triggered a few hours after the domain admin password was rotated.

I initially feared there was a virus somewhere in the environment and ran AV scans on all workstations and servers. Nothing was found.

I checked the security event logs on the domain controller for event 4625 and surprisingly, there were very few: maybe 3 events that seemed unrelated to the current problem. This confused me as at this point, I had seen this attribute reach over 1000. I researched methods of investigating locked out accounts and started by using Microsoft's account lockout tool. Didn't really find much and pursued other avenues.

Stumbled across Netwrix's account lockout tool. This did identify scheduled tasks on one of the workstations that could be causing these bad login attempts. I investigated this on the workstation (let's call it PC1) in question and deleted those scheduled tasks. The next day, the number was still incrementing at a similar rate.

I also checked for credentials in the credential manager on PC1 and did not find any for the domain admin.

For whatever reason, I decided to check the security event logs on the Hyper-V server hosting the domain controllers and there I found all of the login attempts on the domain admin account. I have no idea why they are appearing in the event logs of the Hyper-V server rather than the domain controller.

The events I saw for failed logins on the domain admin account came from three different workstations (one of which was one that Netwrix identified, PC1).

I checked the event logs on one of the workstations and found more of event 4625. The application triggering the login attempts was consent.exe, which I believe is related to UAC. I could not identify any more information about what process might be causing these failed logins.

I'm not sure where to proceed from here and looking for advice and suggestions for next steps. Happy to provide any more information you believe could be relevant.

Answer 1

May be able to do something via GPO

https://woshub.com/cached-domain-logon-credentials-windows/

-

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

I found it! I noticed a new grouping of three failed sign ins on a different PC so I logged into that one and checked its own event logs. I found an event 4625 that was from the domain admin, although apparently it was a successful login. Checked the PID in task manager and found it was a Veeam backup agent that was still trying to take backups.

I checked the settings and it's trying to use the domain admin credentials to access a shared drive on the Hyper-V to store the backups, which explains why the failed login attempts were appearing in the Hyper-V's event logs.

Apparently, we'd set this up for them a while a back for workstation backups but it didn't work as they wanted. I think it was supposed to be uninstalled but never was. I'll remove it from the affected workstations.