Credentialed vs Unauthenticated Vulnerability Scanning with Azure and Tenable

Objective

This lab measures how authenticated access changes the depth and accuracy of a vulnerability scan. Vulnerability management is a core responsibility in many security roles, and knowing the difference between what a scanner sees from the network and what it finds with valid credentials is fundamental.

It answers one question: if an attacker has valid credentials to a Windows system, how many more vulnerabilities are exposed compared to an external scan?

Lab Environment

The lab was configured in Microsoft Azure:

• Cloud platform: Microsoft Azure
• Virtual machine: Windows 11 Pro
• Scanner: Tenable Vulnerability Management (Basic Network Scan)
• Scan engine: Internal Scanner
• Network Security Group (NSG) configured to allow Tenable scan traffic
• Windows Firewall disabled for lab purposes to allow scanner communication

Before the credentialed scan, the LocalAccountTokenFilterPolicy registry key was modified to enable remote administrative access for the Tenable scanner:

Scan 1: Unauthenticated Basic Network Scan

The first scan ran without any Windows credentials. Tenable scanned the Azure VM from the network perspective only. It could not authenticate into the operating system and was limited to what it could observe from the outside.

Without credentials, Tenable could only identify vulnerabilities detectable from the network: open ports, service banners, externally observable SSL/TLS weaknesses, and network-exposed service vulnerabilities. It had no visibility into the operating system's patch state, installed software versions, registry settings, or local configuration details.

Scan 2: Credentialed Scan

The second scan used the same Tenable configuration with Windows local administrator credentials added. This gave Tenable authenticated access to the operating system, so it could inspect the host from the inside.

With valid credentials, Tenable could access installed software lists, missing Windows patches, registry configuration, local security settings, service configurations, and application-level vulnerabilities. This is the kind of visibility a real vulnerability management program depends on.

Scan Comparison

The credentialed scan revealed roughly four times more vulnerabilities than the unauthenticated scan. That is expected, and it shows why credentialed scanning is the standard in enterprise vulnerability management programs.

From an attacker's perspective, the comparison shows what changes with valid credentials: the attacker gains visibility into the same additional attack surface the credentialed scanner reveals.

Screenshots

Key Takeaways

• Unauthenticated scans are useful for identifying externally visible network exposure, but they represent only a fraction of actual host risk.
• Credentialed scans provide the accurate, complete picture that vulnerability management programs require for prioritization and remediation.
• CVSS scores help prioritize vulnerabilities, but only if the scanner can actually discover them, which requires credentials.
• NSG configuration and Windows Firewall rules directly affect scan results. Misconfigured access controls can silently reduce scan coverage.
• Cloud lab environments should be properly cleaned up after testing to avoid unnecessary cost and security exposure.
• The LocalAccountTokenFilterPolicy registry modification is required to enable remote admin access for Tenable on modern Windows systems.

Skills Demonstrated