A security scan identified a PowerShell command line executed under the fglam.exe process of the Foglight Agent Manager (FglAM).
The command retrieves and decodes the msDS-ManagedPassword attribute for the group Managed Service Account (gMSA) used by Foglight via the Get-ADServiceAccount cmdlet. This activity produced plaintext password data in the command output.
The security tool categorized this behavior as potential credential‑dumping activity.
The gMSA query returns only a hash, which is then used to establish the connection. The password must be retrieved in real time by the FglAM, as it is stored in Active Directory and is not known prior to retrieval.
The decoded password exists only in plain text within the FglAM’s memory and is not exposed outside of the FglAM host. Instead, the client decodes and uses the password locally to obtain/compute Kerberos credentials (tickets), and then the HTTP exchange carries SPNEGO/Kerberos tokens (service tickets / authenticators), not the plaintext password. The password is present locally, but Kerberos doesn’t transmit it. For NTLM authentication, the process relies on the password hash rather than the clear‑text password. Provided that Basic Authentication is not in use, there is no risk of the password being transmitted or exposed in clear text.
This behavior is normal and to be expected when FglAM is using gMSA.
If gMSA authentication is not being used, this behavior can be disabled by adding the JVM option -Dfglam.disable_gmsa_lookup=true to the [FGLAM_HOME]/state/default/config/baseline.jvmargs.config configuration file; for example:
vmparameter.X = "-Dfglam.disable_gmsa_lookup=true";Replace X with the next number in the sequence of existing JVM options.