SCCM Site Takeover via Automatic Client Push Installation

tl;dr: Install hotfix KB15599094 and disable NTLM for client push installation.

While reading SCCM Current Branch Unleashed and stepping through the site installation process, I found something interesting — the primary site server’s domain computer account is required to be a member of the local Administrators group on the site database server.

During site installation, this account is also added to the sysadmins group in the site database.

This means that if:

1. automatic site assignment and automatic site-wide client push …

account administrators application security automatic client computer configuration management current database domain install installation local ntlm penetration testing pentesting process red team sccm server social engineering takeover