ADTRADE-008: Key Admins / Enterprise Key Admins Group Membership
- Platform
- Active Directory
- Category
- AD Adversary Tradecraft Indicators
- Severity
- High
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The Key Admins (domain RID 526) and Enterprise Key Admins (RID 527) groups are granted the right to write the msDS-KeyCredentialLink attribute across the domain/forest. That makes any member a domain-wide shadow-credential primitive: a member can plant key credentials on any account and authenticate as it via PKINIT. These groups ship EMPTY and should stay empty unless a specific Windows Hello for Business key-provisioning workflow demonstrably requires them. Any member is an escalation path that must be justified.
Recommended value
Key Admins and Enterprise Key Admins groups are empty (no standing members).
Remediation
Review every member of Key Admins and Enterprise Key Admins. Remove any account that does not have a documented, ongoing need to provision Windows Hello for Business keys. If WHfB key provisioning requires delegated rights, scope them to a dedicated service account with the narrowest possible permissions rather than membership in these domain-wide groups. Treat unexpected members as a potential persistence mechanism.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6, AC-2
- ANSSI
- vuln1_permissions_keycredentiallink
- CIS AD Benchmark
- 6.2.2
- MITRE ATT&CK
- T1556, T1098