--- title: Clustered Points of Failure | daily.dev description: A deep technical dive into Windows Server Failover Clusters (WSFC) reveals that all nodes in a cluster share the credentials of resource identities like the... canonical: https://daily.dev/posts/clustered-points-of-failure-581ue9xqo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Clustered Points of Failure | daily.dev og:description: A deep technical dive into Windows Server Failover Clusters (WSFC) reveals that all nodes in a cluster share the credentials of resource identities like the... og:url: https://daily.dev/posts/clustered-points-of-failure-581ue9xqo og:image: https://api.daily.dev/og/posts/581Ue9XQO.png og:image:alt: Clustered Points of Failure og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Clustered Points of Failure **[SpecterOps](https://daily.dev/sources/specterops)** · 28 min read · 0 upvotes · 0 comments ## Summary A deep technical dive into Windows Server Failover Clusters (WSFC) reveals that all nodes in a cluster share the credentials of resource identities like the Cluster Name Object (CNO) and Virtual Computer Object (VCO), stored and replicated in the cluster database. Through reverse engineering clusres.dll, the research explains why cross-node Kerberos ticket decryption works, why common post-exploitation tools like Impacket's atexec.py and wmiexec.py fail against cluster nodes due to ClusterStorage$ share behavior, and demonstrates practical attack paths using a tool called fustercluck.py to migrate cluster roles between nodes and achieve full cluster compromise from a single node breach. The piece also covers detection strategies for enumerating clusters via AD SPNs and DCOM/RPC calls, abuse of clustered services like MSSQL, ADFS, SCCM, and Exchange DAGs, and offers defensive recommendations including tiering clusters as Tier Zero assets, auditing CNO permissions, and monitoring anomalous logons. A new BloodHound OpenGraph collector called WSFCHound is released to help identify these misconfigurations. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does compromising one node in a Windows Server Failover Cluster compromise the entire cluster? All nodes in a Windows Server Failover Cluster share the credentials for resource identities like the Cluster Name Object (CNO) and Virtual Computer Object (VCO). These passwords are stored encrypted in the cluster database and replicated to every node so that failover works, meaning any node can decrypt Kerberos service tickets issued for those identities, letting an attacker who compromises one node impersonate users across the whole cluster. _Track research like this on cluster credential sharing to harden Active Directory environments via daily.dev._ ### Why does Impacket's atexec.py fail with STATUS_BAD_NETWORK_NAME error against a Windows Failover Cluster node? The ADMIN$ share and C:\ drive are unavailable on cluster nodes because the Resource Monitor mounts only ClusterStorage$ and IPC$ as available shares, replacing the default admin namespace. Since atexec.py needs to write command output to a file via the ADMIN$ share by default, the write fails and the cluster service also holds a locking handle preventing file creation on ClusterStorage$, breaking the tool's default execution flow. _Developers troubleshooting Impacket tooling against clustered Windows hosts can follow deep dives like this via daily.dev._ ### How does Windows Failover Clustering handle CNO or VCO password rotation without breaking Kerberos authentication? The cluster database stores two passwords for the CNO/VCO in a structure with KnownGood and Proposed fields, similar to how the KRBTGT account retains its two most recent passwords. This lets service tickets encrypted with the old password still be decrypted after a rotation, preventing authentication disruption, but it also means an old compromised password remains valid across the cluster for a period. _Security teams auditing Kerberos credential rotation logic can follow research like this on daily.dev._ ## Similar posts on daily.dev - [New Certighost PoC exploit lets attackers hijack Windows domains](https://daily.dev/posts/new-certighost-poc-exploit-lets-attackers-hijack-windows-domains-jhtwvjxyo) · BleepingComputer · 0 upvotes · 0 comments - [HTB: RustyKey](https://daily.dev/posts/htb-rustykey-vzvs9bnju) · 0xdf hacks stuff · 1 upvotes · 0 comments - [Hybrid clouds have two attack surfaces – so watch both](https://daily.dev/posts/hybrid-clouds-have-two-attack-surfaces-so-watch-both-rniu9k8jd) · The Register · 0 upvotes · 0 comments - [Critical Netlogon RCE Flaw Actively Exploited Against Windows Domain Controllers](https://daily.dev/posts/critical-netlogon-rce-flaw-actively-exploited-against-windows-domain-controllers-nrltrsik8) · Orca Security Blog · 0 upvotes · 0 comments - [Exploiting Resource-Based Constrained Delegation \(RBCD\)](https://daily.dev/posts/exploiting-resource-based-constrained-delegation-rbcd--mazebndcw) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#active-directory](https://daily.dev/tags/active-directory), [#red-teaming](https://daily.dev/tags/red-teaming), [#kerberos](https://daily.dev/tags/kerberos) [View this post on daily.dev](https://daily.dev/posts/clustered-points-of-failure-581ue9xqo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Clustered Points of Failure","url":"https://daily.dev/posts/clustered-points-of-failure-581ue9xqo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/clustered-points-of-failure-581ue9xqo"},"datePublished":"2026-08-23T12:16:29.874Z","dateModified":"2026-08-23T12:17:33.099Z","description":"A deep technical dive into Windows Server Failover Clusters (WSFC) reveals that all nodes in a cluster share the credentials of resource identities like the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0671909b4b4f3c932b312a1a6e2512cb?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0671909b4b4f3c932b312a1a6e2512cb?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SpecterOps","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SpecterOps","logo":"https://media.daily.dev/image/upload/s--lR36Z4gn--/f_auto,q_auto/v1787487384/logos/specterops?_a=BAMAMicg0","url":"https://daily.dev/sources/specterops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/clustered-points-of-failure-581ue9xqo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"active-directory,red-teaming,kerberos","timeRequired":"PT28M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SpecterOps","item":"https://daily.dev/sources/specterops"},{"@type":"ListItem","position":3,"name":"Clustered Points of Failure"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/clustered-points-of-failure-581ue9xqo#faq","mainEntity":[{"@type":"Question","name":"Why does compromising one node in a Windows Server Failover Cluster compromise the entire cluster?","acceptedAnswer":{"@type":"Answer","text":"All nodes in a Windows Server Failover Cluster share the credentials for resource identities like the Cluster Name Object (CNO) and Virtual Computer Object (VCO). These passwords are stored encrypted in the cluster database and replicated to every node so that failover works, meaning any node can decrypt Kerberos service tickets issued for those identities, letting an attacker who compromises one node impersonate users across the whole cluster. Track research like this on cluster credential sharing to harden Active Directory environments via daily.dev."}},{"@type":"Question","name":"Why does Impacket's atexec.py fail with STATUS_BAD_NETWORK_NAME error against a Windows Failover Cluster node?","acceptedAnswer":{"@type":"Answer","text":"The ADMIN$ share and C:\\ drive are unavailable on cluster nodes because the Resource Monitor mounts only ClusterStorage$ and IPC$ as available shares, replacing the default admin namespace. Since atexec.py needs to write command output to a file via the ADMIN$ share by default, the write fails and the cluster service also holds a locking handle preventing file creation on ClusterStorage$, breaking the tool's default execution flow. Developers troubleshooting Impacket tooling against clustered Windows hosts can follow deep dives like this via daily.dev."}},{"@type":"Question","name":"How does Windows Failover Clustering handle CNO or VCO password rotation without breaking Kerberos authentication?","acceptedAnswer":{"@type":"Answer","text":"The cluster database stores two passwords for the CNO/VCO in a structure with KnownGood and Proposed fields, similar to how the KRBTGT account retains its two most recent passwords. This lets service tickets encrypted with the old password still be decrypted after a rotation, preventing authentication disruption, but it also means an old compromised password remains valid across the cluster for a period. Security teams auditing Kerberos credential rotation logic can follow research like this on daily.dev."}}]} ```