Microsoft Configuration Manager (MECM, formerly SCCM) can run code as SYSTEM on every managed Windows device, so whoever controls the site, its database or its accounts controls the estate. A typical hierarchy also stores domain credentials for network access, client push and task sequences, and its site server computer account is sysadmin on the site database, which makes MECM one of the most common paths from a single foothold to Tier 0. This guide covers how identity and access work in a Configuration Manager site, which roles and accounts are privileged, how to secure the service accounts and communication channels, and what to log and measure. It is for Configuration Manager administrators, Windows infrastructure engineers and security teams responsible for Active Directory tiering.
Key takeaways
- MECM is a Tier 0 system when it manages Tier 0 assets. If it deploys software to domain controllers or other Tier 0 servers, its site servers, SMS Providers, site database and Full Administrators are all Tier 0; otherwise keep those assets out of its management scope.
- Remove the network access account where you can. With HTTPS or enhanced HTTP, clients do not need it for distribution point content, and its credentials are delivered to every client in policy, where they can persist in the WMI repository after removal.
- Client push is an NTLM relay risk. Disable automatic site-wide client push and "Allow connection fallback to NTLM", and keep push accounts as local administrators on workstations only, never Domain Admins.
- Use roles, scopes and collections for every administrator. Full Administrator should be a handful of named, MFA-protected accounts; everyone else gets built-in roles scoped to the collections they manage.
- Script and application deployment are remote execution. Keep "Script authors require additional script approver" on, require MFA for SMS Provider access where supported, and audit deployments.
How identity and access work in Configuration Manager
A Configuration Manager site has a site server, a site database on SQL Server, one or more SMS Providers (the WMI and AdminService interface used by the console and automation), management points that hand policy to clients, and distribution points that serve content. Clients authenticate to management points and distribution points with their computer identity, a PKI client certificate, or a token issued under enhanced HTTP, and they run deployed content as Local System.
| Component | What it does | Identity and privilege |
|---|---|---|
| Site server | Runs site services and initiates connections to site systems | Its computer account is local administrator on all site systems, sysadmin on the site database SQL instance, and a default member of SMS Admins |
| Site database (SQL Server) | Stores all configuration, inventory, policy and RBAC data, including the RBAC_Admins table | Anyone who can write to it can grant themselves Full Administrator |
| SMS Provider and AdminService | WMI and REST interface for the console, scripts and automation | Members of the local SMS Admins group can reach it; actions are then filtered by role-based administration |
| Management point | Delivers policy, including secrets such as network access account credentials, to clients | Its computer account has database roles such as smsdbrole_MP |
| Distribution point | Hosts content, PXE and boot images | Content shares may contain credentials in scripts and packages |
| Client | Runs deployments, scripts and task sequences as Local System | Holds policy secrets in WMI; ccmcache must not be writable by users |
Communication security
- HTTPS with PKI: Microsoft's recommended configuration. Use PKI certificates wherever possible and require clients to sign data sent to management points, with SHA-256 once all clients support it.
- Enhanced HTTP: where PKI is not available, the site issues an SMS Role SSL Certificate (from the SMS Issuing root) to management points and distribution points, and clients receive tokens. It removes the need for a network access account and client PKI certificates for content access. Enable it under Site Properties, Communication Security, "Use Configuration Manager-generated certificates for HTTP site systems". Sites that allow plain HTTP client communication have been deprecated since version 2103.
- Trusted root key: pre-provision it by extending the schema and publishing the site to AD DS, or through client push, so a new client does not trust the first management point it meets.
The Machine Identity, PKI and Certificate Lifecycle Guide covers the certificate lifecycle that HTTPS mode depends on.
Admin roles and privileged access
Role-based administration combines three elements into an administrative scope: a security role (what the user can do), security scopes (which object instances they see) and collections (which users and devices they can target). Configuration Manager ships 15 built-in roles; built-in roles cannot be edited, so you copy a role to make a custom one.
| Role | Power | Control |
|---|---|---|
| Full Administrator | All permissions, all scopes and all collections; granted automatically to the installing user | Two to four named accounts, phishing-resistant MFA, used from privileged access workstations |
| Security Administrator | Manages administrative users, roles, scopes and collection assignments | Equivalent to Full Administrator in practice; same controls |
| Infrastructure Administrator | Creates and modifies site infrastructure | Site system changes can add servers that receive the site server's credentials |
| Operations Administrator | Everything except managing security | Can deploy to any collection it can see; scope tightly |
| Application Administrator and Application Deployment Manager | Create and deploy applications | Code execution as SYSTEM on target collections; restrict to non-Tier 0 collections |
| Operating System Deployment Manager | Task sequences, boot images, OS images | Task sequences often embed credentials; review them |
| Remote Tools Operator | Remote control and remote desktop | Interactive access to user sessions; log and limit collections |
| Read-only Analyst | Views all objects | Still exposes inventory useful for reconnaissance |
- Least privilege: Microsoft recommends mapping tasks to built-in roles first, assigning several built-in roles rather than building one large custom role, and not using sites as administrative boundaries.
- Separate collections by tier: keep Tier 0 servers in their own collections that only Tier 0 administrators can target, or better, manage them with a separate tool. The Misconfiguration Manager project (PREVENT-22) warns against managing assets in two or more segmented forests, domains, networks or security tiers from one hierarchy.
- Scripts: Run Scripts uses separate Script Author, Script Approver and Script Runner roles. Keep the hierarchy setting "Script authors require additional script approver" enabled in production, as Microsoft recommends, and do not put secrets in scripts.
- SMS Provider authentication: Configuration Manager can require certificate authentication or Windows Hello for Business with an MFA claim for SMS Provider access, so a stolen administrator password alone cannot drive the hierarchy.
- SQL sysadmin: Full Administrators need sysadmin on the site database instance for setup and upgrades. Some organisations use just-in-time sysadmin access instead of standing membership; Microsoft documents this model.
See the Tiered Administration and Enterprise Access Model Guide for how to place MECM in a tier model.
Integrations, API tokens and service accounts
| Account | Why it exists | Microsoft guidance and hardening |
|---|---|---|
| Network access account (NAA) | Content access for clients that cannot use their computer account: workgroup, untrusted domains, some OS deployment steps | Not needed with HTTPS or enhanced HTTP except for multicast, some task sequence content options and SMB fallback. Minimum rights (Access this computer from the network on distribution points), no interactive logon, no domain join rights. Replace rather than re-password it |
| Client push installation account | Connects to ADMIN$ on targets and installs the client | Local administrator on targets only, never Domain Admin; Deny log on locally through Group Policy; separate accounts for workstations and servers |
| Site system installation account | Installs and manages site system roles | Local admin on site systems plus Access this computer from the network; use FQDN names so Kerberos is used |
| Task sequence run as account | Runs steps under a named account instead of Local System | Never Domain Admin, never the NAA, no roaming profile, one account per task sequence |
| Task sequence domain join account | Joins imaged machines to the domain | Domain join rights only, scoped to the target OUs, no interactive logon |
| Reporting services point account | Reads the site database for SSRS | Granted smsschm_users automatically; keep it read-only |
| Software update point connection account | WSUS configuration and synchronisation when the site server account cannot be used | Local admin on the WSUS server; see the WSUS Security Guide |
| Site server computer account | Default identity for many connections | Local admin on site systems and sysadmin on SQL; protect it as Tier 0 and block NTLM relay paths |
- Secrets persist on clients: NAA credentials, collection variables and task sequence secrets are delivered as policy and stored in WMI. The Misconfiguration Manager project documents that they can remain in the CIM repository (C:\Windows\System32\wbem\Repository\OBJECTS.DATA) after removal, so disable legacy NAAs in Active Directory and change their passwords rather than only removing them from the console.
- PXE and boot media: protect PXE with a strong password, disable command support in PXE boot configuration, and restrict PXE to authorised VLANs, because boot media can expose policy secrets.
- Distribution point shares: scan content and site server shares for embedded credentials, SSH keys and scripts with passwords.
- Automation and AdminService: integrations that call the AdminService or WMI need an identity with a scoped role, not Full Administrator, and their credentials belong in a secrets manager.
- Cloud attach: co-management, tenant attach and the cloud management gateway add Entra app registrations and certificates. Inventory them alongside on-premises accounts. See the Microsoft Intune Guide.
Logging and detection
| Signal | Where | What it shows |
|---|---|---|
| Event 4732 on SMS Providers | Security log, with Object Access auditing enabled | Additions to the local SMS Admins group, which mirror inserts into the RBAC_Admins table; an addition by the SYSTEM account outside a planned change is suspicious |
| Site server computer account logons from other hosts | Security logs on site systems and SQL | The site server account authenticating from anywhere other than the site server suggests relay |
| Client push account logons | Security logs on clients and DCs | Push accounts authenticating from anything other than the primary site server |
| Audit status messages | Configuration Manager console, Monitoring | Application deployments, script approvals and runs, and changes to administrative users and roles |
| Read access to the System Management container | DC Security log with a SACL | Reconnaissance of site servers published in AD |
| Scripts.log and CcmMessaging.log | C:\Windows\CCM\Logs on clients | Scripts executed on a device and their source |
| SQL Server audit | Site database instance | Logins and writes to RBAC tables from unexpected principals |
These detections are drawn from the Misconfiguration Manager DETECT techniques and Microsoft's logging documentation. Forward them to your SIEM and test each one. The Active Directory Security Monitoring and Event IDs Guide covers the DC-side events, and the NTLM Relay Guide covers relay detection.
Metrics
- Full Administrators: count of accounts with Full Administrator or Security Administrator (target fewer than five, all MFA-protected).
- Credential accounts: number of configured NAAs, push accounts and run-as accounts, and the share that are documented exceptions.
- Communication mode: percentage of sites on HTTPS or enhanced HTTP (target 100%).
- Relay exposure: site systems without SMB signing, LDAP signing and channel binding, or EPA on the site database and AD CS (target zero).
- Tier separation: Tier 0 devices managed by the general hierarchy (target zero).
- Patch level: site version and hotfix currency, measured against Microsoft's in-console updates.
Hardening baseline
- Patch the site: stay on a current Configuration Manager version and install hotfixes. CISA added CVE-2024-43468, a Configuration Manager remote code execution flaw (SQL injection), to the Known Exploited Vulnerabilities catalogue in February 2026. For client push, KB15599094 fixes a bug in versions before 2207 where connections fell back to NTLM even when fallback was disabled. See the Patch Management Guide.
- Move to HTTPS or enhanced HTTP: enable it in Site Properties, wait for management points to receive certificates (up to 30 minutes), check mpcontrol.log, then remove the NAA if no remaining scenario needs it.
- Retire legacy NAAs properly: disable the old account in AD and change its password, because copies persist on clients.
- Fix client push: disable automatic site-wide client push, untick "Allow connection fallback to NTLM", deny local logon for push accounts, and use separate push accounts per tier.
- Close relay paths: require SMB signing on site systems, LDAP signing and channel binding on DCs, Extended Protection for Authentication on AD CS web enrolment and the site database, disable WebClient on site servers, and block unnecessary SMB, MSSQL and SMS Provider traffic to site systems with host firewalls. Test each change in a pilot site first, because some roles share servers and ports.
- Tighten role-based administration: review every administrative user, remove standing Full Administrator, and scope roles to collections by tier.
- Harden PXE and OS deployment: strong PXE password, command support disabled, PXE limited to build VLANs, and per-task-sequence run-as accounts.
- Protect the ccmcache: confirm C:\Windows\ccmcache cannot be written or renamed by non-administrators.
- Roll back safely: back up the site (site maintenance backup task) before changes, and change one communication or authentication setting at a time so you can revert it if clients stop reporting.
Decision guidance
- HTTPS versus enhanced HTTP: choose PKI-based HTTPS when you already run an enterprise CA with automated client certificate enrolment; choose enhanced HTTP when you do not, accepting that peer-to-peer content, state migration point, remote tools and reporting are not covered by it.
- One hierarchy or several: small organisations usually run one primary site; keep domain controllers out of it and patch them by other means. Large or segmented organisations should run a separate, minimal management path for Tier 0 rather than one hierarchy spanning tiers or forests.
- Client push or other install methods: where you can deploy the client through Group Policy, Intune or images, turn client push off entirely and delete the push accounts.
Common misconfigurations
- Domain Admin as the push or NAA account: the credential reaches every client in policy or every target over SMB, so any workstation compromise exposes it.
- NAA left configured after moving to enhanced HTTP: forgotten accounts with valid passwords remain recoverable from clients.
- Site database on a separate SQL server with relay paths open: coercing the site server account and relaying it to MSSQL or SMB on the database server gives full hierarchy control, the TAKEOVER techniques in Misconfiguration Manager.
- MECM managing domain controllers: collapses the tier model, because every application administrator can now run code on Tier 0.
- Script self-approval enabled: one compromised author account can run arbitrary PowerShell on any collection it can target (T1072 Software Deployment Tools).
- Credentials in task sequences and packages: plain-text passwords in collection variables, scripts on distribution point shares and boot media.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | MITRE ATT&CK |
|---|---|---|---|
| Role-based administration and Full Administrator control | AC-2, AC-6 | PR.AA-05 | T1072 Software Deployment Tools |
| NAA, push and run-as accounts | IA-5, AC-6 | PR.AA-01 | T1552 Unsecured Credentials, T1078.002 Domain Accounts |
| HTTPS, enhanced HTTP and signing | SC-8, SC-23 | PR.DS-02 | T1557 Adversary-in-the-Middle |
| NTLM relay prevention | IA-2, SC-7 | PR.AA-03 | T1187 Forced Authentication, T1557.001 |
| Script and deployment approval | CM-3, CM-5 | PR.PS-01 | T1059.001 PowerShell |
| Patching and monitoring | SI-2, AU-6 | PR.PS-02, DE.CM-03 | T1190 Exploit Public-Facing Application |
Practitioner checklist
- Decide whether MECM is Tier 0; if it is not, remove domain controllers and other Tier 0 assets from its collections.
- List every Full Administrator and Security Administrator and cut the list to a few named, MFA-protected accounts.
- Move all sites to HTTPS or enhanced HTTP and remove the network access account where no scenario requires it.
- Disable and re-password any legacy NAA in Active Directory.
- Disable automatic site-wide client push and NTLM fallback, and confirm push accounts are not Domain Admins.
- Require SMB signing, LDAP signing and channel binding, and EPA on the site database and AD CS.
- Keep script self-approval disabled and review audit status messages for deployments to sensitive collections.
- Alert on 4732 changes to SMS Admins and on site server or push accounts authenticating from unexpected hosts.
- Harden PXE with a strong password, no command support and VLAN restrictions.
- Scan task sequences, collection variables and distribution point shares for embedded credentials.
Standards and references
- Microsoft Learn: Plan for security in Configuration Manager
- Microsoft Learn: Accounts used in Configuration Manager
- Microsoft Learn: Fundamentals of role-based administration
- Microsoft Learn: Enhanced HTTP
- Microsoft Learn: Create and run PowerShell scripts from the Configuration Manager console
- SpecterOps: Misconfiguration Manager, SCCM attack and defence knowledge base
- MITRE ATT&CK: Software Deployment Tools
- CISA: Known Exploited Vulnerabilities Catalog
Related NHI Mgmt Group resources: Patch Management Guide · Windows Services and Service Account Security Guide · NTLM Relay Guide · Service Account Security Guide