ADPRIV-004: Enumeración de Account Operators
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Account Operators puede crear y modificar la mayoría de las cuentas de usuario y de grupo del dominio, incluida la creación de cuentas en OU privilegiadas. Este grupo se pasa por alto con frecuencia, pero ofrece un potencial significativo de escalada de privilegios
Por qué importa
Account Operators inherits a broad set of permissions on the domain partition that do not appear in modern delegation reviews because they are granted via the default domain DACL, not via the group object itself. Members can: - Create, modify, and delete user accounts in any container except Built-in, Domain Controllers, and OUs explicitly removed from inheritance - Reset passwords and unlock most non-protected user accounts - Modify membership of most non-protected groups - Create and join computer accounts to the domain (subject to ms-DS-MachineAccountQuota) - Log on locally to domain controllers by default (Allow log on locally is granted to Account Operators on DCs in legacy SCM baselines) The practical blast radius: an Account Operator can reset the password of any helpdesk, service account, or application admin that is not flagged adminCount=1, then pivot via that identity to higher-tier resources. Because the group is itself protected by SDProp, an attacker who plants an account in Account Operators gets the AdminSDHolder ACL re-stamped onto their controlled principal within 60 minutes, creating persistence that survives standard password resets. The group is also frequently used by attackers as a stepping stone because defenders monitor Domain Admins / Enterprise Admins closely but not Account Operators.
Ruta de ataque
1. Reconnaissance: the attacker enumerates Account Operators membership via BloodHound (SharpHound -CollectionMethod Group) or ldapsearch. Because reading group membership is granted to Authenticated Users by default, this requires no special privilege. 2. Target selection: BloodHound shows AddMember / GenericAll / ForceChangePassword edges from Account Operators to other principals. The attacker identifies a path from a phished low-privilege user to Account Operators (often via a stale nested group or a misconfigured helpdesk role). 3. Initial abuse, password reset: the attacker uses Set-ADAccountPassword or net user against any non-protected target (helpdesk staff, service account owners, application admins). Targets with adminCount=0 are in scope. This is detectable only with 4724 (password reset by another account) auditing enabled. 4. Lateral pivot: with the reset target credentials, the attacker authenticates as a higher-context identity and chains to backup operators, server operators, or unconstrained delegation hosts. Account Operators can also create new machine accounts which bypass ms-DS-MachineAccountQuota gating in some configurations (relevant to sAMAccountName spoofing, CVE-2021-42278). 5. Persistence: the attacker adds a controlled account to Account Operators directly. Within one SDProp cycle (60 minutes default) the AdminSDHolder ACL is mirrored onto the planted principal, and the account inherits Protected Users style ACL hardening that makes routine cleanup tools skip it. The attacker can also use Account Operators to modify membership of other operator groups (Print Operators, Backup Operators) for diversified persistence. 6. Cleanup: legacy delegation paperwork often references Account Operators by name, so a defender reviewing membership may dismiss the planted account as expected.
Cómo lo evalúa Guerrilla
Guerrilla resolves the Account Operators group by well-known SID (S-1-5-32-548) rather than by name, so renamed or localized groups are still caught. It binds via Get-ADGroup -Identity S-1-5-32-548 -Properties member, members, whenChanged, isCriticalSystemObject, then expands the member attribute with Get-ADGroupMember -Recursive to enumerate users, computers, and nested groups. For each member it reads adminCount, userAccountControl, lastLogonTimestamp, pwdLastSet, and servicePrincipalName via a single LDAP query to flag service accounts, dormant identities, and accounts already marked by SDProp. Findings are emitted with the member sAMAccountName, objectClass, recursion path, and a recommended remediation tag (remove-and-delegate). The check works against any reachable DC, does not require RSAT loaded locally beyond the ActiveDirectory module, and never modifies state.
Valor recomendado
Vacío. Utilice permisos delegados a nivel de OU en lugar de la pertenencia al grupo Account Operators
Remediación
Enumere la pertenencia a Account Operators con Get-ADGroupMember -Identity 'Account Operators'. Elimine todos los miembros y reemplácelos con delegación restringida a la OU mediante el asistente de Delegación de control de Active Directory. Documente todos los permisos delegados
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1), AC-6(5)
- CIS Benchmark
- 9.2.4
- ANSSI
- R3
- CIS AD Benchmark
- 4.1.4
- MITRE ATT&CK
- T1078.002, T1098