Forest root compromise via golden ticket SID history abuse

At a glance

What this is: This walkthrough shows how a forged Kerberos ticket with SID history can turn child-domain access into forest-root compromise when SID filtering is missing.

Why it matters: It matters because identity teams often design around domain-level boundaries and miss the trust relationships that actually decide whether privileged access can cross a forest.

Context

A golden ticket attack for Active Directory is a forged Kerberos ticket built from stolen krbtgt material, and SID history abuse adds a privileged group SID from another domain into that ticket. In this case, the security failure was not the initial child-domain foothold but the assumption that domain separation alone would contain privilege.

The article's core point is that the forest, not the individual domain, is the real security boundary when inter-domain trusts are involved. If SID filtering is not enforced, a ticket minted in one domain can be accepted in the forest root, which turns a contained compromise into a forest-wide identity failure.

Key questions

Q: What breaks when SID filtering is not enforced on an Active Directory trust?

A: A forged Kerberos ticket can carry a privileged SID across the trust boundary and be accepted in a higher-trust domain. That turns a child-domain compromise into forest-wide authority. The control failure is not just misconfiguration. It is the collapse of the boundary that should strip unauthorized identity claims before they reach the root.

Q: Why does child-domain admin access sometimes lead to forest-wide compromise?

A: Child-domain admin access can expose replication rights and krbtgt material, which lets an attacker mint tickets that survive normal logon controls. If the forest root also trusts injected SID history, the attacker can cross domains and reach the root domain controller. The risk is the chain, not any single step.

Q: What signs suggest Active Directory trust paths are too exposed?

A: Warning signs include broad machine-account creation rights, direct workstation-to-domain-controller reachability, and limited monitoring of Netlogon authentication flows. If low-privileged domain members can reach privileged parsing paths without segmentation or approval controls, a parser flaw can become an outage event rather than a contained failure.

Q: How should teams recover after a golden ticket with SID history attack?

A: Contain the trust path first, then rotate krbtgt in every affected domain and verify that forest-root administration is isolated from child-domain access. Recovery is incomplete until the same forged ticket can no longer be accepted anywhere in the forest.

Technical breakdown

How SID history turns a forged ticket into cross-domain privilege

A golden ticket is a forged Kerberos ticket-granting ticket created from the krbtgt hash, which lets an attacker impersonate accounts within a domain. SID history injection adds an extra security identifier, often from a privileged group in another domain, so the ticket carries rights it should not have. The control failure is not cryptography alone but trust validation at the boundary: if the trust does not strip the foreign SID, the ticket can present as legitimate privilege in a wider scope than the attacker should ever hold.

Practical implication: validate whether trusts are filtering extra SIDs before treating domain compromise as domain-contained.

Why forest-root compromise is possible after child-domain admin access

Child-domain domain-admin-equivalent access gives the attacker enough rights to extract krbtgt material through DCSync and then mint tickets offline. Once the forged ticket includes the forest root Enterprise Admins SID, the attack no longer depends on the original child domain session. The forest root domain controller becomes the target because it trusts the presented identity claims unless quarantine is enforced. This is a boundary enforcement problem, not a host compromise problem.

Practical implication: review inter-domain trust settings as part of forest-root exposure analysis, not just endpoint or DC hardening.

Why krbtgt rotation alone does not close the chain

Rotating krbtgt is necessary after a golden ticket path, but it does not explain why the forged ticket worked in the first place. The chain depends on two conditions: a reusable ticket-signing secret and a trust path that honours injected privilege claims. If either the trust remains unfiltered or privileged administration is not tiered, the same compromise pattern can recur. Recovery therefore has to address both ticket validity and privilege containment across the forest.

Practical implication: pair credential recovery with administrative tier isolation and trust quarantine validation.

Threat narrative

Attacker objective: The attacker wanted forest-wide control by moving from child-domain access to root-domain credential dumping and durable ticket forgery.

1. Entry began with domain-admin-equivalent access in the child domain, gained through other findings already present in the engagement.
2. Credential access followed when the attacker used replication rights to DCSync the child domain krbtgt hash from a domain controller.
3. Escalation occurred when the attacker forged a golden ticket and injected the forest root Enterprise Admins SID as an extra SID.
4. Impact landed after SID filtering was not enforced on the trust, allowing DCSync against the forest root and full NTDS dump of the environment.

NHI Mgmt Group analysis

SID filtering was the broken governance assumption, not the ticket itself. The attack worked because the trust assumed foreign privilege claims would be stripped before they reached the forest root. That assumption fails when inter-domain quarantine is disabled, and the implication is that trust relationships have to be governed as identity control surfaces, not just network plumbing.

Forest-wide privilege isolation is the real control boundary in Active Directory. A child-domain compromise becomes a forest compromise when tiered administration is weak enough that root privileges remain reachable through delegated identity paths. This is not a scanner finding in isolation; it is an attack-path failure that only appears when trust, replication rights, and administrative separation are evaluated together.

Golden ticket abuse exposes a credential lifecycle problem as much as an authorisation problem. Once krbtgt material is harvested, the attacker can keep minting tickets until the secret is rotated in both affected domains. That means recovery is a governance issue over secret lifetime and reach, not only a forensic exercise after compromise.

Domain trust design is an identity model decision, not an infrastructure afterthought. The article shows that access control assumptions embedded in trusts can defeat otherwise sensible domain hardening if cross-domain claims are honoured too broadly. Practitioners should read this as a reminder that identity architecture determines whether a compromise stays local or becomes a forest event.

Attack-path thinking has to replace point-finding thinking for Active Directory. Replication rights, forged tickets, and unfiltered SIDs are individually survivable findings, but together they create a complete privilege-crossing chain. The practical conclusion is that identity programs need trust-boundary validation as a standard control objective.

What this signals

Attack-path validation is now the practical test for Active Directory trust design. A trust that looks acceptable on paper can still fail when a forged ticket is replayed through it, which is why domain isolation has to be proven rather than assumed. Forest root compromise should be treated as the governance failure mode whenever child-domain privileges can be extended upward through SID history.

The useful question for identity teams is not whether a domain controller is hardened, but whether a compromised child domain can still reach the forest root through trust semantics. That is where privilege crossing becomes visible, and it is where tiered administration and quarantine settings either hold or collapse.

For practitioners

• Enforce SID filtering on every inter-domain trust Verify quarantine settings on child-to-root and forest trusts, then confirm that extra SIDs are stripped before they can be honoured by the forest root.
• Isolate forest-root administration with tiered access Keep forest-root credentials and administrative workflows separate from child-domain admin paths so a child compromise cannot be reused upward.
• Treat krbtgt rotation as a two-domain recovery task After a golden ticket event, rotate krbtgt in both domains and validate that no cached trust path still accepts the forged ticket claims.
• Test trust boundaries with attack-path validation Use path-based assessment to prove whether a forged ticket from the child domain can reach the forest root and trigger replication actions.
• Audit replication rights across domain controllers Review which principals can DCSync each domain, because replication rights are the step that turns ticket forgery into credential theft at scale.

Key takeaways

• SID history abuse turns a forged Kerberos ticket into a cross-domain privilege path when trust filtering is missing.
• The incident shows that child-domain compromise can escalate to full forest compromise if root privileges remain reachable through the trust.
• SID filtering, krbtgt recovery, and forest-root administration isolation are the controls that matter most in this attack pattern.

Key terms

• Golden Ticket: A Golden Ticket is a forged Kerberos ticket created from stolen domain-level cryptographic material. It gives the attacker durable access that can survive ordinary account resets, which makes it a persistence mechanism inside the identity layer.
• SID History Injection: SID History injection is an Active Directory attack where an attacker adds unauthorized security identifiers to a user or service account. The goal is to make that account inherit access linked to a privileged group or older domain identity, enabling escalation, persistence, and stealthy access to resources.
• SID Filtering: SID filtering is a trust control that removes foreign security identifiers from an access token when accounts cross forest boundaries. It helps prevent attackers from abusing SIDHistory or other imported identifiers to gain unauthorized access in a trusting forest. It should be enabled unless an active migration or consolidation requires temporary exceptions.
• KRBTGT: KRBTGT is the Active Directory account that signs Kerberos Ticket Granting Tickets. Because it anchors trust for the domain, compromise of this account lets an attacker mint forged tickets and impersonate identities across the environment.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.