NTLM Relay from SCCM Clients
Last updated
Was this helpful?
Last updated
Was this helpful?
Prerequisites :
Automatic Site-wide client push installation is enabled
NTLM is not explicitly disabled
With access to domain credentials or a session with Full Administrator privileges to Microsoft Configuration Manager (or ConfigMgr, formerly System Center Configuration Manager and still commonly referred to as SCCM), you can very likely gain access to any client machine that is online. But how? Using WMI queries, the ConfigMgr PowerShell cmdlets, or tools like SharpSCCM, MalSCCM, and PowerSCCM.
Identify :
the FQDN or NetBIOS name of an SCCM management point server
the sitecode for the SCCM site.
Confirm that the current domain context has the necessary privileges to define a collection of systems and deploy applications to it :
Find :
systems where our target user has recently logged on
or which computer is their workstation.
The accuracy of the output of this command should not be treated as fact. The LastLogonUser attribute identifies the last account that logged into the system at the point in time the last data discovery collection was sent from the client to the management point (default: every 7 days), so it is likely going to be stale for devices with multiple daily users.
Request NTLM authentication :
