Skip to main content

​
Overview

Analyze automatic client push installation settings from the SMS Provider. This reveals security-relevant configuration including push accounts and authentication settings.
Security Impact: Client push accounts often have administrative privileges across the domain. Identifying these accounts can reveal high-value targets for credential attacks.

​
Syntax

SharpSCCM get site-push-settings [options]

​
Parameters

​
sms-provider
string
The IP address, FQDN, or NetBIOS name of the SMS Provider to connect to
​
site-code
string
The three-character site code (e.g., “PS1”)

​
Examples

# Get client push settings from current site
SharpSCCM get site-push-settings

# Specify SMS Provider and site
SharpSCCM get site-push-settings -sms SCCM01.corp.local -sc PS1

​
Required Permissions

SMS Admins local group membership on the SMS Provider server

​
Security Analysis

Client Push Installation Accounts:
  • Often domain administrator accounts
  • Used for remote client installation
  • May have excessive privileges
NTLM Fallback Configuration:
  • Whether NTLM authentication is allowed
  • Fallback mechanisms for failed installations
  • Authentication security settings
Automatic Installation Scope:
  • Which systems are targeted for automatic push
  • Installation triggers and conditions
  • Target system types and filters
Credential Targeting:
  • Identify client push accounts for credential attacks
  • Target accounts with broad administrative access
  • Focus on accounts with domain-wide privileges
Installation Abuse:
  • Exploit NTLM fallback if enabled
  • Target systems in automatic push scope
  • Abuse installation mechanisms for lateral movement

​
Output Analysis

The command reveals push installation configuration including:
  • Installation accounts and their privilege levels
  • Authentication methods and fallback options
  • Target scope and installation criteria
  • Security settings and restrictions

​
Common Use Cases

Identify high-value administrative accounts used for client push operations.
Understand client push configuration to identify potential attack vectors and misconfigurations.
Map administrative accounts and their access patterns for privilege escalation planning.