Privileged groups: Domain Admins, Enterprise Admins, Backup Operators
You audit every group that can run the domain, expose an administrator hidden through nested groups with a chain query, catch an unexpected member of a built-in operator group, check the Protected Users group, and prepare the effective admin list and the findings report yourself. The hidden admin and the operator are different in every lab.
Level 201 · 50 min
CORP’s IT manager speaks with confidence: "There are only three administrators in the domain." As the auditor you have to verify this, because in real life admin rights often spread in unexpected ways.
Analogy: a building’s master key. When you ask who has it, they say "three people". But someone may have put the key in a cabinet, and someone else may hold the cabinet key. In AD that cabinet is a nested group: a group is made a member of Domain Admins, and every member of that group quietly becomes an administrator.
There are powerful groups besides Domain Admins: Enterprise Admins and Schema Admins (forest level), the built-in Administrators, Account Operators (manage accounts), Server Operators (log on to DCs), Backup Operators (can back up the DC’s database, i.e. read every password hash) and Print Operators. The figure orders them by power.
After the lab starts, this lab’s own changes are made in the background; your first query gives a complete answer after about 30 seconds.
What you will do in this lesson
- The direct members of Domain Admins
- Forest level and the built-in Administrators
- Look inside the cabinet: the nested group’s members
- The whole chain in one query: 1.2.840.113556.1.4.1941
- The built-in operator groups
- Protected Users
- The effective admin list
- The privileged groups report
- Short quiz
Skills you will earn
- Auditing the members of privileged groups
- Finding admins hidden through nested groups
- Querying indirect members with the chain rule (1.2.840.113556.1.4.1941)
- Auditing the built-in operator groups
- Auditing the Protected Users group
- Writing audit findings into a report
← Querying the directory with LDAP: filters and attributes · Active Directory security: auditing and hardening · Finding unused and disabled accounts →
Start for free