Last updated
Last updated
In a Windows environment, the majority of computers will be domain-joined and will therefore authenticate to SCCM Software Distribution Points (SDPs) (basically just SMB shares) using their own machine account credentials. However, some computers may not be domain-joined. Network Access Account credentials (NAAs) are domain credentials intended to be used by these machines to access the SDPs over the network. They are passed to the machines as part of the SCCM machine policies, which are then encrypted using DPAPI and stored locally. If they are present, privileged users can retrieve these credential blobs via WMI or directly from disk and decrypt them to recover plaintext credentials.
Use local naa with -m wmi or -m disk.
These credentials should only have read access to the SDP, but are often times over privileged (sometimes even domain/enterprise admins).
An alternate approach is to request a copy of the policy directly from SCCM using get naa. This also requires local admin on the local machine to obtain a copy of its SMS Signing and SMS Encryption certificates.