Topic starter
16/01/2026 5:34 pm
TL;DR: Microsoft’s built-in password rotation for on-premises NHIs can be undermined through machine account password tampering or time manipulation, allowing attackers to preserve access and evade detection, according to Silverfort. The control assumption is fragile: rotation only protects credentials when time, trust, and account-state synchronisation remain intact.
Editorial analysis by NHI Mgmt Group, based on content published by Silverfort: “Service Accounts: From Security Measure to Silent Foothold”.
Key questions
Q: What breaks when Active Directory password rotation is tampered with?
A: Rotation stops being evidence that the credential lifecycle is controlled.
Q: Why does time manipulation increase the risk of persistent NHI access?
A: Because managed rotation logic depends on timestamps to decide when a credential should change.
Q: What are the signs that NHI password rotation is failing in Active Directory?
A: Look for unexpected Event ID 4616 time changes, Event ID 4742 computer-account password changes, and PwdLastSet values that do not match the expected rotation cadence.
Practitioner guidance
- Audit rotation trust assumptions Map every NHI rotation process to the system that owns the authoritative timestamp, then identify where time changes or direct password writes can bypass that ownership.
- Monitor time-change and password-change events Alert on Event ID 4616 and Event ID 4742 together so investigators can correlate clock tampering with computer-account password updates.
- Verify PwdLastSet drift patterns Look for machine and service accounts whose PwdLastSet values move outside expected cadence or change after suspicious clock adjustments.
Bottom line: Active Directory rotation can fail when attackers tamper with the process that certifies when an NHI password should change.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
06/10/2026 11:49 pm
Rotation is not a control if the account-state source of truth can be rewritten. Active Directory password rotation assumes that the system enforcing expiry and the system holding the credential remain in sync. When an attacker can tamper with that relationship, the governance model is no longer credential lifecycle management in the normal sense. The practical conclusion is that rotation must be treated as dependent on integrity controls around state, not as a standalone safeguard.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should teams treat machine account rotation and service account rotation the same way?
A: No. Machine accounts often rotate through the client host, while managed service accounts are enforced by the domain controller, so the failure modes are different. Machine account tampering often looks like direct password modification, while service account abuse often looks like time-based delay. Governance has to reflect the control owner for each identity type.
👉 Read our full editorial: Active directory password rotation can be subverted to keep NHI access