SpecterOps: a Windows iSCSI Target Server set up without CHAP lets any host that knows the target and an authorised initiator name read the shared disks below file permissions, a Hyper-V domain controller's among them

SpecterOps shows that the Windows iSCSI Target Server role, set up as a community cluster guide describes it with the optional CHAP step skipped, accepts a login from any host that knows the target host, the target name and an authorised initiator name (SpecterOps, 2026-11-04). The post says the role registers a service principal name on its computer account, so a directory query lists the target hosts, that initiator names are built from the host's DNS name and are therefore predictable, and that in the author's experience the service has no rate limiting or brute-force protection (SpecterOps, 2026-11-04). Access is below the file system, so NTFS permissions do not apply, and volume encryption such as BitLocker defeats it (SpecterOps, 2026-11-04). The worst case the post shows is a volume that holds a Hyper-V domain controller's virtual disk, from which the local credential stores and the directory database can be taken (SpecterOps, 2026-11-04). The author has not tested the technique in production and warns that it can cause outages, and the post cites no Microsoft response.