ADPRIV-001: Domain Admins Enumeration
- Platform
- Active Directory
- Category
- AD Privileged Account Security
- Severity
- Critical
- Zero Trust pillar
- Identity (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The check resolves the Domain Admins group by its well-known SID (S-1-5-21-<domain>-512), reads the member attribute, and recursively expands every nested group, every foreign-security-principal, and every account referenced through SID history. For each resolved principal the check records: - sAMAccountName, distinguishedName, and objectSid - objectClass (user, computer, group, foreignSecurityPrincipal, msDS-GroupManagedServiceAccount) - userAccountControl flags (ACCOUNTDISABLE, DONT_REQUIRE_PREAUTH, PASSWORD_NOTREQD, TRUSTED_FOR_DELEGATION) - pwdLastSet, lastLogonTimestamp, and whetherSmartcardLogonRequired - adminCount (should be 1 for any current or historical protected member) - Membership in the Protected Users group - Any servicePrincipalName values (a member of Domain Admins with an SPN is a Kerberoasting catastrophe) The roster is then evaluated against the hygiene baseline: total count, presence of day-to-day user accounts, presence of computer accounts, presence of service accounts, presence of disabled or stale accounts that have not been cleaned up, and any member that lacks Protected Users membership or smartcard enforcement.
Why it matters
Domain Admins is one of the three groups (with Enterprise Admins and Schema Admins) that sits at Tier 0 of the Microsoft administrative tier model. Any credential theft event that yields a Domain Admin token, hash, or Kerberos ticket is, by definition, a full-domain compromise: the holder can DCSync krbtgt, forge Golden Tickets, modify GPOs linked to the Domain Controllers OU, and persist indefinitely. Every additional member multiplies the attack surface in two ways. First, it adds another endpoint, mailbox, and browser session where a phishing payload or info-stealer can land a Tier-0 credential. Second, it adds another account that may be assigned an SPN, marked TRUSTED_FOR_DELEGATION, or left with a static password, each of which converts directly into a domain-takeover primitive. Mandiant and Microsoft Incident Response have repeatedly attributed major ransomware incidents (Ryuk, Conti, BlackCat, LockBit) to the simple fact that the victim ran ten, twenty, or fifty Domain Admins, of which one was reachable from a workstation. The Microsoft guidance is unambiguous: Domain Admins should contain only the break-glass account during steady-state operation, with named admins added temporarily through a privileged access workstation.
Attack path
1. Enumeration: from any authenticated context the attacker queries Domain Admins with a single LDAP call (Get-ADGroupMember "Domain Admins" -Recursive, net group "Domain Admins" /domain, or BloodHound SharpHound -CollectionMethod Group,Session). The group is readable by Authenticated Users by default. 2. Target selection: the attacker cross-references members against session data (BloodHound HasSession edges, qwinsta, Get-NetSession) to find a Domain Admin whose token is currently cached on a Tier-1 or Tier-2 host the attacker already controls. 3. SPN abuse, if any DA carries a servicePrincipalName: the attacker requests a service ticket (Rubeus kerberoast /user:<DA>) and cracks the resulting TGS offline. A Kerberoastable DA is the fastest known path from a low-privilege user to Domain Admin and requires no exploit, only LDAP read and KRB_TGS_REQ. 4. Token or hash theft: with code execution on a host where the DA has logged on, the attacker dumps LSASS (mimikatz sekurlsa::logonpasswords, comsvcs.dll MiniDump, nanodump) or steals the Kerberos TGT (Rubeus dump /service:krbtgt) and reuses it via pass-the-hash or pass-the-ticket. 5. Persistence: once the attacker authenticates as a Domain Admin, they run DCSync (mimikatz lsadump::dcsync /user:krbtgt or impacket-secretsdump) to extract krbtgt and forge Golden Tickets, then add a backdoor ACE to AdminSDHolder or a hidden member to Domain Admins itself. 6. Cleanup: the attacker rotates the original DA credential to suppress detection, leaving the krbtgt-derived Golden Ticket as the persistent path.
How Guerrilla assesses it
Guerrilla binds to a writable DC, resolves the domain SID, and reads the group at S-1-5-21-<domain>-512 via Get-ADGroup with -Properties member, member;range, and msDS-MembersOfGroupTransitive where available. Membership is expanded recursively in PowerShell rather than relying on -Recursive alone, so nested foreign-security-principals from trusted domains and tombstoned references are surfaced rather than silently dropped. For every resolved member the check pulls the supporting attributes (userAccountControl, pwdLastSet, lastLogonTimestamp, servicePrincipalName, adminCount, memberOf) in a single LDAP call to minimise round trips. The Protected Users membership lookup is performed against the Protected Users SID (S-1-5-21-<domain>-525). All queries are LDAP-only so the check works against any reachable DC and does not require RSAT loaded locally. Findings are emitted with the member DN, the path used to reach the group (direct or via nested group chain), and every attribute that contributes to the risk score so an analyst can triage without re-querying AD.
Recommended value
Minimal membership (ideally 2-3 accounts maximum) with documented justification for each member. No day-to-day user accounts
Remediation
Enumerate Domain Admins membership including nested groups using Get-ADGroupMember -Identity 'Domain Admins' -Recursive. Review each member for business need. Remove unnecessary members and migrate to delegated administration models. Ensure no regular user accounts are members
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6(1), AC-6(5), AC-2(7)
- CIS Benchmark
- 9.2.1
- ANSSI
- R2
- CIS AD Benchmark
- 4.1.1
- MITRE ATT&CK
- T1078.002, T1069.002