---
id: 9466
title: "Wait, Why is my WebClient Started?: SCCM Hierarchy Takeover via NTLM Relay to LDAP"
source_domain: specterops.io
source_url: "https://specterops.io/blog/2026/01/14/wait-why-is-my-webclient-started-sccm-hierarchy-takeover-via-ntlm-relay-to-ldap/"
published_at: "2026-01-14T17:00:00Z"
phying_url: "https://phying.com/item/9466"
lang: en
---

# Wait, Why is my WebClient Started?: SCCM Hierarchy Takeover via NTLM Relay to LDAP

## Summary

During automatic client push installation, an SCCM site server automatically attempts to map WebDav shares on clients, starting WebClient when installed.

## Intelligence Metadata

- **Sources:** specterops.io
- **Published:** 2026-01-14T17:00:00Z
- **Original:** https://specterops.io/blog/2026/01/14/wait-why-is-my-webclient-started-sccm-hierarchy-takeover-via-ntlm-relay-to-ldap/
- **Phying News:** https://phying.com/item/9466