“Stolen credentials are involved in 44.7% of breaches,” Verizon found — a stark figure that explains why the first reflex after a suspected account takeover is so often to reset a password. But in environments that use Active Directory (AD) or hybrid Entra ID, that single step frequently leaves gaps an attacker can exploit.
The password reset gap
Windows machines cache password hashes to permit offline logons, and hybrid deployments introduce synchronization delays between AD and Entra ID. Those two behaviors create three distinct states after a password reset: the user has updated credentials and an endpoint has refreshed its cache; the user has not logged into a specific machine and the old cached credential may still work there; or the AD password has been changed but the new hash has not yet synchronized to Entra ID and the old hash can still authenticate during the password hash synchronization interval. Because those states can coexist across different devices and services, a single reset does not instantly cut every authentication path.
Cached credentials and pass‑the‑hash exploitation
Attackers take advantage of cached password hashes. Techniques like pass‑the‑hash use the hash itself rather than the plaintext password, meaning a captured hash can be used despite a subsequent password reset. The source describes solutions such as Specops uReset, which enforces end‑user ID verification during self‑service password resets to reduce reset abuse, and — when combined with the Specops Client — can update the local cached credential store immediately on the device where the reset is performed. That immediate update reduces the interval during which an old hash remains usable on that endpoint, narrowing the attacker’s window at the network edge.
Kerberos tickets, active sessions, and forged tickets
AD authentication often relies on Kerberos tickets rather than repeated password checks. Valid Kerberos tickets allow continued access without re‑entering credentials; an attacker with active tickets can keep accessing resources after a password change unless sessions are explicitly terminated. The source highlights two ticket‑forging techniques: Golden Ticket attacks, which rely on a compromised Kerberos Ticket Granting Ticket account to create ticket‑granting tickets for any user in the domain, and Silver Ticket attacks, which forge tickets targeted at specific services. Resetting user passwords does not invalidate forged tickets; the recommended mitigations include terminating active sessions by forcing logoffs or reboots and, for significant compromises, resetting the KRBTGT account twice to invalidate forged tickets.
Service accounts, ACLs, and automated re‑elevation
Service accounts and directory permissions provide persistent avenues for attackers. Service accounts often have long‑lived passwords and elevated privileges and are less likely to be reset quickly because of the risk of disrupting services. Attackers can obtain those credentials through techniques such as Kerberoasting or lateral discovery. AD’s access model — heavily driven by Access Control Lists (ACLs) — lets attackers create or modify accounts and delegate rights that survive a simple password change. The source notes that accounts protected by the AdminSDHolder object inherit permissions from a template and that changes to the AdminSDHolder ACL can be re‑applied automatically by SDProp on an hourly cadence, enabling attackers to maintain or regain privileged access unless the directory is audited and corrected.
What this means for security teams, IT administrators, and procurement leaders
- Security teams should treat a password reset as the start, not the finish, of remediation: terminate sessions, force logoffs or reboots, clear cached credentials as systems reconnect, rotate service account passwords, and, where necessary, reset the KRBTGT account twice to invalidate forged Kerberos tickets. They must also audit group memberships, delegated rights and ACLs, and privileged accounts and roles for hidden persistence.
- IT administrators can reduce synchronization latency by enabling AD Change Notification or manually initiating a sync to the Entra ID tenant, and should prioritize clearing local cached credential stores and rotating service credentials on affected endpoints.
- Procurement leaders and risk owners evaluating identity tooling may consider solutions described in the source — for example, Specops uReset combined with the Specops Client — which the vendor says enforces end‑user verification for self‑service resets and can immediately update a device’s cached credential store to close one exposure window.
There is no single toggle that guarantees attacker eviction. The time between a password change and synchronization is typically small — “just a few minutes” — but attackers can exploit even short windows and build persistence through sessions, forged tickets, service credentials, or directory ACLs. Effective remediation therefore layers actions: invalidate active authentication material, rotate the right credentials, and audit and repair directory permissions until no hidden path remains.
