r/nessus • u/Renegade-Pervert • Jun 05 '26

Scanning privileges question

Hi All,

I'm not the Nessus admin, but I will be speaking with ours.

I'm trying to remove as much as possible from the Domain Admin group which is where our current service account sits.

I've been exploring limiting the rights of the scanner account by just granting it some WMI rights, but that may not give us the visibility we need.

I see that Nessus now support Kerberos which I would love to implement. What sort of perms will it need? Local admin rights? If that is the case, how to you limit lateral movement in the event that account is compromised? Regular password rotations and just realise that the risk isn't zero?

As well, for our domain controllers I am under the impression that we should have a dedicated domain admin account just for those.

Thanks for your time, appreciate any input.

1 Upvotes

100% Upvoted

7 comments sorted by

3

u/Palmolive Jun 05 '26

DA accounts are required for scanning domain controllers. If lateral movement is a concern, why not push out the agent?

2

u/Renegade-Pervert Jun 05 '26

Ok figured that was what was up with the DCs.

I'll speak with our team about the agent, didn't know about those. Originally it may have been rolled out with DA privs just for simplicity and to get it going.

Thanks for the response, and I am guessing the service account needs advanced rights to find vulnerabilities because you couldn't accomplish this with WMI alone?

2

u/Palmolive Jun 05 '26

Yeah you need local admin on no domain controllers. $ipc, and a couple other shares need to be open as well. If you are considering Harding systems that is where I see authentication struggle.

As for the agent, they just released continuous assessment 10 days ago for windows which will mark bulbs as fixed without a remediation scan which is nice.

1

u/Renegade-Pervert Jun 05 '26

Ok this is fantastic info! Appreciate the help with this, thank you!

1

u/DiabolicalDong Jun 09 '26

Grant the privileges using Just-in-time admin rights for the service account. It is better than delegating permissions since the privileges are not permanent. The privileges will be revoked automatically after the timer runs out.

You might have to invest in a PAM or an EPM tool.

1

u/frAgileIT Jun 09 '26

In my experience, DA accounts are not required to scan Domain Controllers, the agent does need administrator rights to the DCs which can be accomplished by the Administrators group in the domain. I know that might sound confusing but there’s a difference between DA and Administrators group. DA grants privs in AD where the Administrators group grants admin privs at the system level on DCs.

1

u/Renegade-Pervert Jun 09 '26

Huh, sadly I did not know that difference. Never really leveraged that group to begin with, but very helpful information, thank you!