Arbitrary enrollment lets an attacker turn a single stolen account into a durable access path. Even if a session cookie expires or MFA is reset, a newly enrolled attacker-controlled device can look like a legitimate workstation and continue joining the domain. That converts short-lived credential theft into longer-lived access that is harder to distinguish from normal administration.
Why arbitrary device enrollment turns stolen credentials into a persistence problem
Arbitrary device enrollment changes the meaning of credential theft because the attacker is no longer limited to replaying a password or stealing a session. Once they can register a new device under the victim’s account, they can create a fresh, trusted foothold that survives password resets, expired cookies, and some forms of session revocation. That matters most when enrollment is treated as a convenience feature rather than a trust decision. Guidance from the MITRE ATT&CK Enterprise Matrix is useful here because persistence often depends on re-establishing a trusted access path after initial compromise.
The security issue is not enrollment itself, but who is allowed to bind a new device into the trust relationship and what checks happen before that trust is extended. If the process accepts only valid credentials and weak secondary proof, then the attacker can impersonate a normal user long enough to create a durable endpoint. In practice, many security teams discover the persistence value of device enrollment only after a stolen account has already been converted into a trusted workstation, rather than during the original credential theft.
How device enrollment extends the attacker’s foothold
Arbitrary enrollment works because many identity and access systems treat a newly enrolled device as evidence of continuity. The enrollment event can grant access to internal portals, conditional access exceptions, device-based trust, or management channels that are harder to disrupt than a password alone. Once the attacker owns that enrolled endpoint, they can often keep returning through a path that appears legitimate to the directory, device compliance layer, or endpoint trust logic.
The mechanism usually has three parts: valid credentials open the door, enrollment records create the new trust anchor, and ongoing policy logic continues to recognise the enrolled device. If the organisation relies heavily on “known device” signals, a stolen account can become a long-lived access path even after user password changes. That is why the control question is not only whether authentication is strong, but whether device registration is itself protected as a high-value security boundary.
- Enrollment can outlast a single login session because trust is attached to the device, not just the token.
- Device identity can become the attacker’s persistence layer when revocation only targets the password or current session.
- Conditional access that trusts enrolled devices without strong proof of device ownership can preserve the attacker’s foothold.
In environments with endpoint management, the risk grows when enrollment also grants access to policy sync, mailbox access, or internal applications. The attacker then gains more than continuity: they gain a managed presence that can blend into normal administration. The guidance breaks down when enrollment requires strong, out-of-band proof of device possession or when device trust is short-lived and routinely revalidated.
Where the edge cases and trade-offs appear
Tighter enrollment controls often increase helpdesk friction, device onboarding time, and exception handling, so organisations have to balance user convenience against trust durability. That trade-off becomes visible in bring-your-own-device programs, remote work environments, and recovery workflows, where teams may be tempted to loosen checks so users can self-serve access.
The common edge case is account recovery. If a user can both regain access and immediately re-enrol a device with little challenge, the recovery path becomes an attacker-friendly persistence mechanism. Another edge case is administrative enrollment rights: if helpdesk or delegated admin processes can enroll devices broadly, compromise of those workflows can scale the same persistence issue across many accounts. There is also disagreement across the industry about how much device trust should be treated as an authentication factor versus an access signal, and that distinction matters because it changes how aggressively revocation must be enforced.
One practical rule is to treat enrollment authority as a separate trust decision from login success. When the enrolment step can create or refresh durable access, it deserves the same scrutiny as privilege assignment. Where that boundary is blurred, device trust becomes a quiet persistence channel instead of a control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 5 — Account Management | Enrollment abuse depends on weak account and trust administration. |
| Recommendation — Restrict device enrollment rights and remove stale trusted-device records quickly. | ||
| NIST CSF 2.0 | PR.AC-1 — Identity and Access Management | Device enrollment changes how access is established and maintained. |
| PR.AC-4 — Access Permissions and Authorizations | Enrollment can create a new durable authorization path for the attacker. | |
| Recommendation — Revalidate trusted-device access paths after credential resets and recovery events. Limit which devices can gain standing trust through conditional access policy. | ||
| MITRE ATT&CK | T1098 — Account Manipulation | Arbitrary enrollment can be used to persist by altering trusted access state. |
| T1136 — Create Account | Attackers may establish a new enduring identity or device-backed access path. | |
| Recommendation — Hunt for unauthorized trust changes that create persistent access after stolen-credential use. Alert on new trusted endpoints or accounts created during compromised sessions. | ||
Practitioner Guidance
What to prioritise: Treat device enrollment as a privileged trust event, not a user convenience feature. The highest-value fix is to reduce who can enroll, under what conditions, and how quickly that trust can be revoked.
What to verify: Confirm that password resets, token revocation, and MFA re-enrolment do not leave previously enrolled devices accepted by policy. If an old device can still satisfy trust decisions after account recovery, persistence remains available to the attacker.
Decision rule: If enrollment can happen with only stolen credentials, require stronger proof before the device becomes trusted, and make that proof materially harder to replay than the original login. If the process cannot do that, treat it as a persistence weakness rather than a minor onboarding issue.
What practitioners underestimate: The lasting risk is often not the initial compromise, but the new control plane the attacker gains through enrollment. Once a device is accepted as “known,” many downstream checks become less suspicious by design.
Practitioner takeaway: The real danger is not that the attacker logs in once, but that enrollment lets them convert one valid credential into a durable identity foothold that normal recovery steps may fail to remove.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
