SCCM Misconfigurations Expose Organizations to Full Infrastructure Takeover

Microsoft Configuration Manager, commonly known as System Center Configuration Manager (SCCM), is widely deployed across Russian enterprises and serves as a high-value target for attackers. According to BI.ZONE SOC data, the platform operates in 25 percent of Russian organizations, predominantly large ones managing thousands of devices. Successful compromise typically grants full infrastructure control, enabling administrative privilege acquisition, lateral movement, user and device reconnaissance, persistence through arbitrary code execution, and policy manipulation.

Core Principles for Secure SCCM Deployment

Proper infrastructure planning at the deployment stage significantly reduces the attack surface. Site Server, SMS Provider, and Site Database Server roles must reside in the most protected Tier 0 network segment. Clients should never interact directly with these roles. Separate servers in a DMZ are required for external clients, and administrative operations should be performed exclusively via jump hosts.

Active Directory tiering must be respected: a single SCCM hierarchy should never manage assets from multiple forests or security tiers. Separate isolated SCCM infrastructures are recommended for Tier 0 assets such as domain controllers and hypervisors.

Least Privilege for SCCM Service Accounts

The Network Access Account (NAA) should be decommissioned wherever possible. Its credentials are stored encrypted on every managed client and can be extracted by local administrators using SharpSCCM, SharpDPAPI, or mimikatz. Organizations are advised to switch to HTTPS or Enhanced HTTP on distribution points and disable all previously used NAA accounts in Active Directory.

When NAA cannot be removed, the account must be a dedicated service account with minimal rights, interactive and remote desktop logons disabled, and monitored via Event ID 4624/4625 type 3 entries originating only from distribution point servers.

The Client Push Account used for forced client installation must also follow strict controls. Separate accounts should be created for different security tiers, added only to necessary local administrator groups via Group Policy, and never placed in Domain Admins. Source IP monitoring is required to detect anomalous usage.

Computer accounts of site servers and accounts used for domain join operations during operating system deployment sequences require similar restrictions. Domain join accounts must receive delegated rights only on temporary organizational units and must never reside in privileged groups.

Common Misconfigurations and Remediation

Absence of network isolation for PXE deployments remains one of the most critical vectors. Attackers who can boot devices over the network can extract credentials from task sequences or boot images. Database access must be limited to a dedicated SQL instance with the smallest possible number of sysadmin users, as the SC_UserAccount table stores recoverable secrets.

Administrative access to the SCCM console should be granted only to named accounts with appropriate security roles, avoiding generic service accounts that complicate incident investigation.