Shadow IT And Unmanaged Hosts
How Shadow IT And Unmanaged Hosts works
Shadow IT is any device or service on the internal network that no inventory lists. It arrives as a lab machine somebody racked for a project, a contractor laptop plugged into a wall port, a personal device on the corporate SSID, a virtual machine cloned on a hypervisor and never registered, or an appliance a business unit bought that sits on the LAN and syncs to a vendor SaaS. All of them get an address, a route and often a domain join. None of them get an agent, a patch schedule, a scan job or an owner.
For an attacker it is the cheapest foothold on the estate, because unmanaged means unpatched and unmonitored at the same time: an old operating system on a user VLAN, a default credential on an appliance, a share nobody knows exists, and no alert when any of it is touched. It is easy to miss because nothing is broken. The device works, the user is happy, and the only place it would appear as an exception is a reconciliation nobody runs. Discovery that is scoped from the CMDB compounds the problem, since it can never find hosts in the ranges the CMDB does not know about.
Shadow IT And Unmanaged Hosts in practice
Build ground truth from the network, not from the CMDB
Start at the infrastructure devices so the scope comes from what the network actually carries. Layer 2 state also catches hosts that drop probes.
# Routed internal prefixes as the core switch really carries them
ssh netadmin@core-sw01.lab.internal "show ip route connected" > /tmp/routes.txt
ssh netadmin@core-sw01.lab.internal "show mac address-table" > /tmp/mac-table.txt
# Sweep every routed prefix, including ones no inventory mentions
nmap -sn -PE -PS22,80,135,443,445,3389 -PU137 -oG - 10.20.0.0/16 \
| awk '/Up$/{print $2}' > /tmp/sweep.txt
# ARP is the honest answer on a local segment
sudo arp-scan --interface=eth0 --localnet | awk '/^10\./{print $1}' > /tmp/arp-scan.txt
sort -uV /tmp/sweep.txt /tmp/arp-scan.txt > /tmp/live-hosts.txtPull what each management plane claims to know
Every console holds a different partial list. Export them all to one place before comparing anything.
# A lease is a device that asked for an address and was given one
Get-DhcpServerv4Scope -ComputerName dhcp01.lab.internal |
ForEach-Object { Get-DhcpServerv4Lease -ComputerName dhcp01.lab.internal -ScopeId $_.ScopeId } |
Select-Object IPAddress, ClientId, HostName, AddressState |
Export-Csv C:\audit\dhcp-leases.csv -NoTypeInformation
# Domain-joined machines seen in the last month
Get-ADComputer -Filter * -Properties LastLogonDate, OperatingSystem, ManagedBy |
Where-Object { $_.LastLogonDate -gt (Get-Date).AddDays(-30) } |
Select-Object DNSHostName, OperatingSystem, LastLogonDate, ManagedBy |
Export-Csv C:\audit\ad-computers.csv -NoTypeInformationExport the EDR agent list, the hypervisor inventory and the CMDB to the same folder. Pulling names from the internal DNS zones is useful here too, but the zone transfer and enumeration technique itself belongs to the Internal DNS Zone Transfer And Enumeration page.
Reconcile and report the delta
The delta is the deliverable. Resolve first so each unmanaged address carries whatever identity the estate already has for it.
while read -r ip; do
name=$(dig +short -x "$ip" @dns01.lab.internal | sed 's/\.$//')
printf '%s\t%s\n' "$ip" "${name:-NO-PTR}"
done < /tmp/live-hosts.txt | sort -u > /tmp/live-named.tsv
cut -f1 /tmp/cmdb-export.tsv | sort -u > /tmp/cmdb-ips.txt
comm -23 <(cut -f1 /tmp/live-named.tsv | sort -u) /tmp/cmdb-ips.txt > /tmp/unmanaged.txt
wc -l < /tmp/unmanaged.txtADDRESS PTR DHCP AD OBJ EDR CMDB
10.20.14.37 (none) yes no no no
10.20.14.51 buildbox.lab.internal yes yes no no
10.20.31.8 (none) no no no no
10.20.44.120 vc-print02.lab.internal yes no no yesRows with CMDB=no are the unmanaged estate and the finding for this page. Rows that are in the CMDB but missing from a console are a different defect and belong to the EDR And SIEM Coverage Gaps page and to Incomplete Vulnerability Scan Coverage; report them separately so one number is not used to excuse the other.
Characterise the delta without touching it
Fingerprint enough to classify each host, and stop there.
nmap -sS -sV -O --version-intensity 2 -p 22,80,135,139,443,445,3389,5985 \
-iL /tmp/unmanaged.txt -oN /tmp/unmanaged-fingerprint.txt
grep -Ei 'mac address|os details|service info' /tmp/unmanaged-fingerprint.txtDo not authenticate and do not try default credentials during discovery. An unowned host has no owner to call when a lockout or a reboot takes it out, and an unlabelled device on a flat network is as likely to be building control or medical equipment as a spare desktop. Credential testing belongs to the Default Credentials On Devices And Appliances page and runs only against ranges with a named owner. The evidence for the report is the address, the fingerprint, the switch port and the delta count.
How to fix and prevent Shadow IT And Unmanaged Hosts
- Reconcile discovery against the inventory on a schedule
- Join ARP, DHCP, switch MAC tables, DNS, hypervisor and directory data against the system of record daily.
- Route the delta to a named queue with a response time; an unreviewed delta is the same as no discovery.
- Make network admission the enforcement point
- Port-based authentication with an unknown-device VLAN turns “not in the inventory” into “not on the network”. Rollout detail belongs to the Missing Network Access Control (802.1X) page.
- Give every prefix an owner and a default disposition
- Lab, contractor, guest and OT ranges each need an owner, an expiry and a documented reason to exist; an unowned prefix reliably produces unowned hosts.
- Close the provisioning side doors
- Hypervisor and cloud APIs must register new instances into the inventory automatically, and procurement of any network-attached appliance must create an asset record before delivery.
- Report coverage against the inventory, never against the console
- A dashboard reporting full coverage of managed hosts measures the wrong denominator; recalculate every coverage figure against the reconciled asset list.
Last updated
