---
id: 5784
title: "How to Block BadSuccessor: The Good, Bad, and Ugly of dMSA Migration"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/how-to-block-badsuccessor/"
published_at: "2025-07-10T19:59:40Z"
tags: ["active-directory", "privilege-escalation", "powershell", "mitigation", "dmsa", "windows-server-2025", "badsuccessor"]
phying_url: "https://phying.com/item/5784"
lang: en
---

# How to Block BadSuccessor: The Good, Bad, and Ugly of dMSA Migration

## Summary

BadSuccessor lets attackers abuse dMSAs on Windows Server 2025 to impersonate any account, including Domain Admins. A schema-level fix blocks the dMSA migration abuse until Microsoft patches it.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2025-07-10T19:59:40Z
- **Original:** https://www.semperis.com/blog/how-to-block-badsuccessor/
- **Phying News:** https://phying.com/item/5784