⬇ Download holy card: ·
Saint BadSuccessor, Who Named Himself Heir
Patron of delegated managed service accounts, permissions granted too broadly, and 2025 Active Directory domains.
Life
On 21 May 2025 Yuval Gordon of Akamai described BadSuccessor (CVE-2025-53779), which abuses the delegated Managed Service Accounts (dMSA) introduced with Windows Server 2025. Anyone with certain permissions over an organizational unit could create a dMSA and declare it the "successor" of a privileged account: Active Directory then granted it the predecessor's powers, opening the way to escalation across the whole domain.
Prayer
O Saint BadSuccessor, who proclaims yourself heir of one who did not choose you, let our inheritances require the deceased's consent. Amen.
How to celebrate
Celebrated by installing the August 2025 updates and watching who can create delegated managed accounts.
Declare yourself heir, inherit the domain.