Where Multi-Factor Authentication Stops and Credential Abuse Starts

"Enforced through an identity provider (IdP) such as Microsoft Entra ID, Okta, or Google Workspace, MFA works well for cloud apps and federated sign-ins. But many Windows logons rely solely on Active Directory (AD) authentication paths that never trigger MFA prompts. To reduce credential-based compromise, security teams need to understand where Windows authentication happens outside their identity stack."

"When a user signs in directly to a Windows workstation or server, authentication is typically handled by AD (via Kerberos or NTLM), not by a cloud IdP. In hybrid environments, even if Entra ID enforces MFA for cloud apps, traditional Windows logons to domain-joined systems are validated by on-prem domain controllers. Unless Windows Hello for Business, smart cards, or another integrated MFA mechanism is implemented, there's no additional factor in that flow."

"If an attacker obtains a user's password (or NTLM hash), they can authenticate to a domain-joined machine without triggering the MFA policies that protect software-as-a-service apps or federated single sign-on. From the domain controller's perspective, this is a standard authentication request."

Organizations deploying MFA often assume stolen passwords cannot access systems, but this assumption fails in Windows environments due to incomplete MFA coverage. While identity providers like Microsoft Entra ID, Okta, and Google Workspace enforce MFA for cloud apps and federated sign-ins, many Windows logons authenticate through Active Directory without triggering MFA prompts. In hybrid environments, domain-joined systems validate credentials through on-premises domain controllers, bypassing cloud-based MFA policies. Attackers exploit this gap by using stolen passwords or NTLM hashes to authenticate directly to Windows workstations and servers. Security teams must identify and secure Windows authentication paths outside their identity stack, including interactive logons, RDP access, and other authentication methods that currently lack MFA enforcement.

Read at The Hacker News