Credentialed vs. Unauthenticated Vulnerability Scanning with Azure & Tenable

Objective

The goal of this lab was to understand how authenticated access changes the depth and accuracy of a vulnerability scan. Vulnerability management is a core responsibility in many security roles, and understanding the difference between what a scanner sees from the network versus what it finds with valid credentials is fundamental knowledge.

This lab answers the question: If an attacker has valid credentials to a Windows system, how many more vulnerabilities are exposed compared to an external scan?

Lab Environment

The lab was configured in Microsoft Azure:

• Cloud platform: Microsoft Azure
• Virtual machine: Windows 11 Pro
• Scanner: Tenable Vulnerability Management (Basic Network Scan)
• Scan engine: Internal Scanner
• Network Security Group (NSG) configured to allow Tenable scan traffic
• Windows Firewall disabled for lab purposes to allow scanner communication

Before running the credentialed scan, the LocalAccountTokenFilterPolicy registry key was modified to enable remote administrative access for the Tenable scanner:

Scan 1: Unauthenticated Basic Network Scan

The first scan was performed without any Windows credentials. Tenable scanned the Azure VM from the network perspective only - it could not authenticate into the operating system and was limited to what it could observe from the outside.

Without credentials, Tenable could only identify vulnerabilities detectable from the network: open ports, service banners, externally observable SSL/TLS weaknesses, and network-exposed service vulnerabilities. It had no visibility into the operating system's patch state, installed software versions, registry settings, or local configuration details.

Scan 2: Credentialed Scan

The second scan used the same Tenable scan configuration with Windows local administrator credentials added. This gave Tenable authenticated access to the operating system - it could now inspect the system from the inside.

With valid credentials, Tenable could access installed software lists, missing Windows patches, registry configuration, local security settings, service configurations, and application-level vulnerabilities. This is the kind of visibility a real vulnerability management program depends on.

Scan Comparison

The credentialed scan revealed approximately four times more vulnerabilities than the unauthenticated scan. This is expected - and it illustrates why credentialed scanning is considered the standard in enterprise vulnerability management programs.

From an attacker's perspective, this comparison also illustrates what changes when an attacker has valid credentials - they have visibility into the same additional attack surface that the credentialed scanner reveals.

Screenshots

Azure Windows 11 Pro VM - the scan target deployed in Microsoft Azure

Unauthenticated scan results - network-level visibility only (36 findings)

Credentialed scan results - full host-level visibility (147 findings)

Key Takeaways

• Unauthenticated scans are useful for identifying externally visible network exposure, but they represent only a fraction of actual host risk.
• Credentialed scans provide the accurate, complete picture that vulnerability management programs require for prioritization and remediation.
• CVSS scores help prioritize vulnerabilities, but only if the scanner can actually discover them - which requires credentials.
• NSG configuration and Windows Firewall rules directly affect scan results - misconfigured access controls can silently reduce scan coverage.
• Cloud lab environments should be properly cleaned up after testing to avoid unnecessary cost and security exposure.
• The LocalAccountTokenFilterPolicy registry modification is required to enable remote admin access for Tenable on modern Windows systems.

Skills Demonstrated