ADPRIV-027: Privileged Users RDP on DCs
- Platform
- Active Directory
- Category
- AD Privileged Account Security
- Severity
- High
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The check reads the "Allow log on through Remote Desktop Services" User Rights Assignment (SeRemoteInteractiveLogonRight) and, for completeness, the corresponding deny right (SeDenyRemoteInteractiveLogonRight), as evaluated on every Domain Controller in the forest. The data sources are: - The Default Domain Controllers Policy GPO (well-known GUID {6AC1786C-016F-11D2-945F-00C04fB984F9}), parsed from \\<domain>\SYSVOL\<domain>\Policies\{...}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf - Any additional GPO linked to the Domain Controllers OU (DC=...,OU=Domain Controllers) whose security template defines SeRemoteInteractiveLogonRight or SeDenyRemoteInteractiveLogonRight - The local security policy as resolved on each reachable DC via secedit /export and Get-CimInstance Win32_GroupUser, used to confirm what is actually in effect rather than only what is declared - Membership of the Remote Desktop Users (S-1-5-32-555) and Server Operators (S-1-5-32-549) built-in groups on each DC, since both groups grant interactive logon to DCs by default For every principal resolved on the right, the check expands nested groups recursively (including foreign-security-principals from trusted domains) and records: sAMAccountName, objectClass, distinguishedName, objectSid, the GPO and link path that granted the right, and whether the principal is also a member of Domain Admins, Enterprise Admins, Administrators, or Protected Users. The result is compared against a Tier-0-only baseline: only the Administrators built-in group (BUILTIN\Administrators, S-1-5-32-544), populated solely by named Tier-0 admins, should hold SeRemoteInteractiveLogonRight on a DC.
Why it matters
A Domain Controller is the authoritative store for every password hash, every Kerberos long-term key, and every certificate private key bound to a machine identity in the forest. Any interactive logon to a DC, including RDP, loads the logged-on user's credential material into LSASS on the DC and, by the same mechanism, exposes any previously cached Tier-0 credential on that DC to whoever holds SeDebugPrivilege on the box. RDP is the worst case of interactive logon because it persists the session, leaves a desktop, and almost always uses Network-level credential delegation that places a reusable TGT in memory. Granting RDP to a non-Tier-0 identity (a helpdesk group, a server-operations team, a monitoring service account) collapses the tier model: any compromise of that identity becomes a compromise of the DC, and any compromise of the DC is, by definition, a compromise of the forest. The blast radius is total. Mandiant and Microsoft Incident Response have repeatedly documented ransomware operators using a single over-permissioned Remote Desktop Users membership on a DC to pivot from a Tier-1 server breach into a krbtgt DCSync and a Golden Ticket within hours. The Microsoft Tier 0 guidance and the CIS Domain Controller benchmark both treat interactive logon to DCs as the highest-sensitivity right in the directory, second only to the SeBackupPrivilege and SeRestorePrivilege.
Attack path
1. Reconnaissance: from any authenticated context the attacker enumerates the Default Domain Controllers Policy and any GPO linked to the Domain Controllers OU. Tools: Get-GPOReport -All -ReportType Xml, BloodHound CanRDP edge collection (SharpHound -CollectionMethod LocalAdmin,RDP,DCOM,PSRemote), or a direct read of \\<domain>\SYSVOL\...\GptTmpl.inf. The attacker also enumerates Remote Desktop Users and Server Operators on each DC. 2. Target selection: the attacker identifies a non-Tier-0 principal that holds SeRemoteInteractiveLogonRight on a DC, either directly or through a nested group. Common findings include the helpdesk group, a server-administration group, a monitoring service account, or a legacy "DC-RDP-Admins" group created for a long-forgotten migration. 3. Credential acquisition: the attacker compromises the chosen principal using whatever path is cheapest in the environment. Kerberoasting (Rubeus kerberoast) against a non-Tier-0 service account is the most common; phishing or token theft from a helpdesk operator is second most common; abuse of an ACE on the group object (GenericWrite, WriteOwner) is third. 4. Interactive logon: the attacker establishes an RDP session to a DC from a host they control. With Network-level credential delegation enabled (the default), the session ships a reusable TGT to the DC and the attacker now has a Tier-0 shell on the DC itself. 5. Lateral escalation in LSASS: the attacker runs mimikatz sekurlsa::logonpasswords or a stealthier equivalent (nanodump, comsvcs.dll MiniDump) on the DC and harvests every cached Tier-0 credential currently in memory, including the krbtgt service ticket if a real domain admin has recently logged on. 6. Persistence: from the DC the attacker runs lsadump::dcsync /user:krbtgt, forges a Golden Ticket, adds a backdoor ACE to AdminSDHolder, and exits. The original non-Tier-0 RDP grant is left in place because it is the persistence mechanism.
How Guerrilla assesses it
Guerrilla resolves the Domain Controllers OU, then enumerates every GPO linked to that OU (including blocked-inheritance overrides) and the Default Domain Controllers Policy by well-known GUID. For each GPO it parses MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf and extracts the [Privilege Rights] section, specifically SeRemoteInteractiveLogonRight and SeDenyRemoteInteractiveLogonRight. SID strings in the template are resolved against the domain (and trusted domains for foreign-security-principals) to recover friendly names and object classes. The check then expands every group on the right recursively in PowerShell to surface nested non-Tier-0 members. To validate the effective state rather than only the declared state, the check optionally invokes secedit /export against each reachable DC and compares the resolved local policy to the GPO declaration, flagging drift. Built-in group membership (Remote Desktop Users S-1-5-32-555, Server Operators S-1-5-32-549, Administrators S-1-5-32-544) is read on each DC using Get-CimInstance Win32_GroupUser scoped to the local SAM. All queries are LDAP and SMB read-only and do not require RSAT loaded locally. Findings are emitted with the principal DN, the GPO and link path that granted the right, the nesting chain, and whether the principal is Tier-0 or not.
Recommended value
Only designated Tier 0 administrative accounts allowed RDP access to DCs. 'Allow log on through Remote Desktop Services' restricted via GPO
Remediation
Configure via Group Policy applied to Domain Controllers OU: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment > 'Allow log on through Remote Desktop Services' = Administrators only. Consider using Remote Credential Guard or Restricted Admin mode for RDP sessions
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6(1), AC-3, AC-17
- CIS Benchmark
- 2.2.26
- ANSSI
- R7
- CIS AD Benchmark
- 4.10.2
- MITRE ATT&CK
- T1078.002, T1021.001