ADTIER-006: Cuentas de administración de Tier 0 fuera de una OU de Tier 0 dedicada
- Plataforma
- Active Directory
- Categoría
- Tier-0 Hygiene & Hybrid Identity Surface
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Si sus Domain Admins residen en la misma OU que los usuarios normales, cada GPO dirigida a usuarios (scripts de inicio de sesión, directiva de navegador, unidades asignadas, etc.) también se aplica a sus Domain Admins, lo que significa que cualquiera que pueda editar esas GPO puede ejecutar código como Domain Admin en el siguiente inicio de sesión. El modelo por niveles de Microsoft recomienda una OU de administración de Tier 0 dedicada con autoría de GPO restringida y derechos de inicio de sesión restringidos.
Por qué importa
The Microsoft tiered administration model (formerly the Enhanced Security Administrative Environment) exists because credential exposure flows downhill. The moment a Domain Admin token, password hash, or Kerberos TGT lands on a workstation or a member server, an attacker with local SYSTEM on that host can lift it and use it. Co-locating Tier-0 accounts with general user accounts violates the model in three ways. First, every GPO linked above the shared OU applies to Domain Admins, so a Tier-1 helpdesk admin who can edit a logon-script GPO can plant a payload that runs in the context of a Domain Admin at next logon (T1484.001). Second, software installation and browser configuration policies push attacker controllable surface (extensions, MSI packages, proxy PAC URLs) into Tier-0 sessions. Third, GPO scoping cannot grant a "deny logon to workstations" policy cleanly when Tier-0 accounts are sprinkled across the user OU tree, so the accounts end up able to RDP or interactively log on to Tier-1 and Tier-2 hosts, where their credentials are then harvested with mimikatz sekurlsa::logonpasswords, Rubeus dump, or LSASS minidumps. The blast radius of any of these primitives is forest takeover.
Ruta de ataque
1. Reconnaissance: the attacker enumerates Domain Admins with PowerView (Get-DomainGroupMember -Identity "Domain Admins" -Recurse) or BloodHound (SharpHound -CollectionMethod Group,ACL,GPOLocalGroup). The DN of each admin is logged. 2. OU mapping: for every admin DN, the attacker walks up the OU chain and lists the gPLink attribute on each parent container with (Get-ADObject -Identity $ou -Properties gPLink).gPLink. 3. GPO edit rights: the attacker runs Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs and looks for any non-Tier-0 principal with WriteProperty, GenericAll, GenericWrite, or WriteDacl on a groupPolicyContainer that is linked above a Tier-0 user. BloodHound surfaces this as a GenericAll / GenericWrite edge to a GPO node with a path into a high-value user. 4. Payload staging: with edit rights on a qualifying GPO, the attacker uses SharpGPOAbuse (--AddComputerScript, --AddUserScript, --AddImmediateTask) or Group Policy Management Console to add a User Configuration logon script, scheduled immediate task, or Group Policy Preferences item that drops and executes a payload. 5. Trigger: at the next interactive logon by the Tier-0 user (or after gpupdate /force), the payload runs in the Tier-0 user context. The attacker captures the TGT or NTLM hash, performs DCSync, or adds themselves to Domain Admins. 6. Persistence: the attacker leaves the GPO in place. Because GPO changes are noisy but rarely reviewed retroactively, the backdoor often survives multiple credential rotations and incident response cycles. A parallel branch exists when Tier-0 accounts are allowed to log on interactively to Tier-1 or Tier-2 hosts because no logon-restriction GPO exists: the attacker compromises a workstation, waits for or coerces a Tier-0 logon (helpdesk ticket, RDP shadow, runas), and harvests credentials directly from LSASS.
Cómo lo evalúa Guerrilla
Guerrilla resolves the three forest-root groups via Get-ADGroupMember -Recursive, then for each member it reads distinguishedName and tests whether the DN matches the configured Tier-0 OU pattern (-Tier0OU, default OU=Tier-0,OU=Admin). Non-matching members are reported with their full DN and the parent OU. For each non-compliant parent OU the check reads gPLink and expands every linked GPO display name and GUID. For each linked GPO it binds to CN={GUID},CN=Policies,CN=System,DC=domain,DC=tld and walks the DACL, flagging any ACE on a non-Tier-0 trustee that grants WriteProperty, GenericAll, GenericWrite, or WriteDacl. The check also reads the User Rights Assignment section of GPOs linked to the Tier-0 OU (via the GptTmpl.inf in SYSVOL) and verifies SeDenyInteractiveLogonRight, SeDenyRemoteInteractiveLogonRight, and SeDenyNetworkLogonRight contain the Tier-0 group SID on non-DC hosts. Findings include the offending account DN, the parent OU, the inherited GPO list, and any GPO with non-Tier-0 edit rights.
Valor recomendado
Todos los miembros de Domain Admins, Enterprise Admins y Schema Admins están en una OU de Tier 0 dedicada (por lo general OU=Tier-0,OU=Admin) con autoría de GPO restringida.
Remediación
Cree OU=Tier-0,OU=Admin si no existe. Mueva a ella a todos los miembros de Domain/Enterprise/Schema Admins. Restrinja la autoría de GPO en esa OU (solo los propios administradores de Tier 0). Aplique una GPO de restricción de inicio de sesión dedicada para que las cuentas de Tier 0 solo puedan iniciar sesión en hosts de Tier 0. Bloquee la herencia en la OU.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-3, AC-6
- CIS AD Benchmark
- 8.3.1
- MITRE ATT&CK
- T1078