Tommi Haarala
tommihaarala.bsky.social
Tommi Haarala
@tommihaarala.bsky.social
Endpoint Specialist located in Finland. #ConfigMgr #SCCM #Powershell #OSD #Intune
Reposted by Tommi Haarala
#SCCM forest discovery accounts can be decrypted—even those for untrusted forests. If the site server is a managed client, all creds can be decrypted via Administration Service API.

Check out our latest blog post from @unsignedsh0rt.bsky.social to learn more. ghst.ly/4buoISp
Decrypting the Forest From the Trees - SpecterOps
TL;DR: SCCM forest discovery accounts can be decrypted including accounts used for managing untrusted forests. If the site server is a managed client, service account credentials can be decrypted via ...
ghst.ly
March 6, 2025 at 8:34 PM