vSphere Active Directory Security: Research Report

vSphere Active Directory security: A comprehensive research report

When administrators authenticate to VMware vSphere using Active Directory credentials, they reasonably expect passwords to be validated and then forgotten. The reality is far more complex.

This independent security research traces AD credentials across every layer of a vSphere environment, from ESXi 7 and 8 to vCenter Server 7 and 8. The findings reveal that default configurations expose passwords through cleartext LDAP transmissions, world-readable keytabs, and persistent Kerberos ticket caches. On standalone ESXi hosts joined to AD, any administrator can access other users' cached credentials, and the ESXi Admin role is functionally equivalent to Domain Admin when Domain Controller VMs run on the host.

vCenter Server provides stronger authentication through SAML token isolation and granular role-based access control, but only when deliberately configured to use LDAPS or SPNEGO authentication. The default AD-over-LDAP identity source recreates the worst credential exposure at the network layer.

This report documents every vulnerability with packet captures, memory dumps, and functional attack chains, then provides prioritized recommendations to harden your vSphere AD integration.

In this guide, you will learn how to

• Identify where AD credentials are exposed at the network, disk, and memory layers in vSphere environments.
• Understand why standalone ESXi AD domain join creates unfixable architectural security weaknesses.
• Configure vCenter identity sources to eliminate cleartext password transmission using LDAPS or SPNEGO.
• Protect the ESXi admin group with the same rigor as Domain Admins, since AD group membership directly controls hypervisor root access.
• Prevent Kerberos downgrade attacks by enforcing AES-only encryption on ESXi and vCenter computer accounts.
• Restrict ESXi administrator access to hosts running Domain Controller VMs to prevent offline ntds.dit extraction and snapshot rollback attacks.
• Detect credential theft attempts through DC Event 2889 monitoring and file access auditing.

Why download this guide

• Gain visibility into credential flows that default vSphere documentation does not disclose.
• Understand the security trade-offs between standalone ESXi management and vCenter-managed environments.
• Implement prioritized hardening recommendations based on tested attack chains.
• Reduce domain compromise risk by treating ESXi Admin privileges with appropriate sensitivity.
• Strengthen incident response procedures with certificate revocation alongside password resets.