ADPRIV-004: Account Operators Enumeration
- Platform
- Active Directory
- Category
- AD Privileged Account Security
- Severity
- High
- Zero Trust pillar
- Identity (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The check binds to the well-known Account Operators group (SID S-1-5-32-548) in the BUILTIN container of the target domain and reads the member attribute, recursively expanding any nested groups via member;range and the tokenGroups computed attribute. For each direct and transitive principal it records: - sAMAccountName, objectSid, and objectClass (user, group, computer, foreignSecurityPrincipal) - whenChanged on the group object (last membership modification) - adminCount on each member (1 indicates SDProp has already stamped the principal) - isCriticalSystemObject and whether the principal is itself a protected group The Account Operators group is one of the protected groups governed by AdminSDHolder, so any member becomes a protected principal after the next SDProp cycle. The check treats a non-empty membership as a finding regardless of who the member is, because Microsoft Security Best Practices for AD DS explicitly state that Account Operators should be left empty in production.
Why it matters
Account Operators inherits a broad set of permissions on the domain partition that do not appear in modern delegation reviews because they are granted via the default domain DACL, not via the group object itself. Members can: - Create, modify, and delete user accounts in any container except Built-in, Domain Controllers, and OUs explicitly removed from inheritance - Reset passwords and unlock most non-protected user accounts - Modify membership of most non-protected groups - Create and join computer accounts to the domain (subject to ms-DS-MachineAccountQuota) - Log on locally to domain controllers by default (Allow log on locally is granted to Account Operators on DCs in legacy SCM baselines) The practical blast radius: an Account Operator can reset the password of any helpdesk, service account, or application admin that is not flagged adminCount=1, then pivot via that identity to higher-tier resources. Because the group is itself protected by SDProp, an attacker who plants an account in Account Operators gets the AdminSDHolder ACL re-stamped onto their controlled principal within 60 minutes, creating persistence that survives standard password resets. The group is also frequently used by attackers as a stepping stone because defenders monitor Domain Admins / Enterprise Admins closely but not Account Operators.
Attack path
1. Reconnaissance: the attacker enumerates Account Operators membership via BloodHound (SharpHound -CollectionMethod Group) or ldapsearch. Because reading group membership is granted to Authenticated Users by default, this requires no special privilege. 2. Target selection: BloodHound shows AddMember / GenericAll / ForceChangePassword edges from Account Operators to other principals. The attacker identifies a path from a phished low-privilege user to Account Operators (often via a stale nested group or a misconfigured helpdesk role). 3. Initial abuse, password reset: the attacker uses Set-ADAccountPassword or net user against any non-protected target (helpdesk staff, service account owners, application admins). Targets with adminCount=0 are in scope. This is detectable only with 4724 (password reset by another account) auditing enabled. 4. Lateral pivot: with the reset target credentials, the attacker authenticates as a higher-context identity and chains to backup operators, server operators, or unconstrained delegation hosts. Account Operators can also create new machine accounts which bypass ms-DS-MachineAccountQuota gating in some configurations (relevant to sAMAccountName spoofing, CVE-2021-42278). 5. Persistence: the attacker adds a controlled account to Account Operators directly. Within one SDProp cycle (60 minutes default) the AdminSDHolder ACL is mirrored onto the planted principal, and the account inherits Protected Users style ACL hardening that makes routine cleanup tools skip it. The attacker can also use Account Operators to modify membership of other operator groups (Print Operators, Backup Operators) for diversified persistence. 6. Cleanup: legacy delegation paperwork often references Account Operators by name, so a defender reviewing membership may dismiss the planted account as expected.
How Guerrilla assesses it
Guerrilla resolves the Account Operators group by well-known SID (S-1-5-32-548) rather than by name, so renamed or localized groups are still caught. It binds via Get-ADGroup -Identity S-1-5-32-548 -Properties member, members, whenChanged, isCriticalSystemObject, then expands the member attribute with Get-ADGroupMember -Recursive to enumerate users, computers, and nested groups. For each member it reads adminCount, userAccountControl, lastLogonTimestamp, pwdLastSet, and servicePrincipalName via a single LDAP query to flag service accounts, dormant identities, and accounts already marked by SDProp. Findings are emitted with the member sAMAccountName, objectClass, recursion path, and a recommended remediation tag (remove-and-delegate). The check works against any reachable DC, does not require RSAT loaded locally beyond the ActiveDirectory module, and never modifies state.
Recommended value
Empty. Use delegated OU-level permissions instead of Account Operators group membership
Remediation
Enumerate Account Operators membership using Get-ADGroupMember -Identity 'Account Operators'. Remove all members and replace with OU-scoped delegation using Active Directory Delegation of Control wizard. Document all delegated permissions
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6(1), AC-6(5)
- CIS Benchmark
- 9.2.4
- ANSSI
- R3
- CIS AD Benchmark
- 4.1.4
- MITRE ATT&CK
- T1078.002, T1098