ADTIER-006: Tier-0 Admin Accounts Outside a Dedicated Tier-0 OU
- Platform
- Active Directory
- Category
- Tier-0 Hygiene & Hybrid Identity Surface
- Severity
- High
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The check enumerates the recursive membership of the three forest-root privileged groups via LDAP: - CN=Domain Admins,CN=Users,DC=domain,DC=tld - CN=Enterprise Admins,CN=Users,DC=forestroot,DC=tld - CN=Schema Admins,CN=Users,DC=forestroot,DC=tld For each user object returned it parses the distinguishedName and walks up the OU chain. A member is considered compliant only when its DN sits under a dedicated administrative OU pattern (default OU=Tier-0,OU=Admin, configurable via -Tier0OU). The check also reads the gPLink attribute on every OU that contains a Tier-0 user, expands each linked GPO, and inspects the GPO security descriptor (nTSecurityDescriptor on the groupPolicyContainer object in CN=Policies,CN=System) to confirm that GPO edit rights are restricted to Tier-0 principals only. Finally it reads the Default Domain Controllers Policy and any GPO linked to the Tier-0 OU and verifies that a User Rights Assignment policy defining "Deny log on locally", "Deny log on through Remote Desktop Services", and "Deny access to this computer from the network" is applied to the Tier-0 group on all non-Tier-0 hosts.
Why it matters
The Microsoft tiered administration model (formerly the Enhanced Security Administrative Environment) exists because credential exposure flows downhill. The moment a Domain Admin token, password hash, or Kerberos TGT lands on a workstation or a member server, an attacker with local SYSTEM on that host can lift it and use it. Co-locating Tier-0 accounts with general user accounts violates the model in three ways. First, every GPO linked above the shared OU applies to Domain Admins, so a Tier-1 helpdesk admin who can edit a logon-script GPO can plant a payload that runs in the context of a Domain Admin at next logon (T1484.001). Second, software installation and browser configuration policies push attacker controllable surface (extensions, MSI packages, proxy PAC URLs) into Tier-0 sessions. Third, GPO scoping cannot grant a "deny logon to workstations" policy cleanly when Tier-0 accounts are sprinkled across the user OU tree, so the accounts end up able to RDP or interactively log on to Tier-1 and Tier-2 hosts, where their credentials are then harvested with mimikatz sekurlsa::logonpasswords, Rubeus dump, or LSASS minidumps. The blast radius of any of these primitives is forest takeover.
Attack path
1. Reconnaissance: the attacker enumerates Domain Admins with PowerView (Get-DomainGroupMember -Identity "Domain Admins" -Recurse) or BloodHound (SharpHound -CollectionMethod Group,ACL,GPOLocalGroup). The DN of each admin is logged. 2. OU mapping: for every admin DN, the attacker walks up the OU chain and lists the gPLink attribute on each parent container with (Get-ADObject -Identity $ou -Properties gPLink).gPLink. 3. GPO edit rights: the attacker runs Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs and looks for any non-Tier-0 principal with WriteProperty, GenericAll, GenericWrite, or WriteDacl on a groupPolicyContainer that is linked above a Tier-0 user. BloodHound surfaces this as a GenericAll / GenericWrite edge to a GPO node with a path into a high-value user. 4. Payload staging: with edit rights on a qualifying GPO, the attacker uses SharpGPOAbuse (--AddComputerScript, --AddUserScript, --AddImmediateTask) or Group Policy Management Console to add a User Configuration logon script, scheduled immediate task, or Group Policy Preferences item that drops and executes a payload. 5. Trigger: at the next interactive logon by the Tier-0 user (or after gpupdate /force), the payload runs in the Tier-0 user context. The attacker captures the TGT or NTLM hash, performs DCSync, or adds themselves to Domain Admins. 6. Persistence: the attacker leaves the GPO in place. Because GPO changes are noisy but rarely reviewed retroactively, the backdoor often survives multiple credential rotations and incident response cycles. A parallel branch exists when Tier-0 accounts are allowed to log on interactively to Tier-1 or Tier-2 hosts because no logon-restriction GPO exists: the attacker compromises a workstation, waits for or coerces a Tier-0 logon (helpdesk ticket, RDP shadow, runas), and harvests credentials directly from LSASS.
How Guerrilla assesses it
Guerrilla resolves the three forest-root groups via Get-ADGroupMember -Recursive, then for each member it reads distinguishedName and tests whether the DN matches the configured Tier-0 OU pattern (-Tier0OU, default OU=Tier-0,OU=Admin). Non-matching members are reported with their full DN and the parent OU. For each non-compliant parent OU the check reads gPLink and expands every linked GPO display name and GUID. For each linked GPO it binds to CN={GUID},CN=Policies,CN=System,DC=domain,DC=tld and walks the DACL, flagging any ACE on a non-Tier-0 trustee that grants WriteProperty, GenericAll, GenericWrite, or WriteDacl. The check also reads the User Rights Assignment section of GPOs linked to the Tier-0 OU (via the GptTmpl.inf in SYSVOL) and verifies SeDenyInteractiveLogonRight, SeDenyRemoteInteractiveLogonRight, and SeDenyNetworkLogonRight contain the Tier-0 group SID on non-DC hosts. Findings include the offending account DN, the parent OU, the inherited GPO list, and any GPO with non-Tier-0 edit rights.
Recommended value
All Domain Admins, Enterprise Admins, and Schema Admins members are in a dedicated Tier-0 OU (typically OU=Tier-0,OU=Admin) with restricted GPO authorship.
Remediation
Create OU=Tier-0,OU=Admin if it doesn't exist. Move all members of Domain/Enterprise/Schema Admins into it. Restrict the GPO authorship on that OU (only Tier-0 admins themselves). Apply a dedicated logon-restriction GPO so Tier-0 accounts can only log on to Tier-0 hosts. Block inheritance on the OU.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-3, AC-6
- CIS AD Benchmark
- 8.3.1
- MITRE ATT&CK
- T1078