#dmsa

BadSuccessor: How the Feature That Killed Service-Account Attacks Became Domain Admin

Jul 19, 2026

Windows Server 2025 delegated MSAs were built to end kerberoasting. For one summer, a single OU permission turned dMSA succession into Domain Admin rights.