ADTIER-006: Tier-0 Admin Accounts Outside a Dedicated Tier-0 OU
- Plataforma
- Active Directory
- Categoría
- Tier-0 Hygiene & Hybrid Identity Surface
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check enumerates the recursive membership of the three forest-root privileged groups via LDAP: - CN=Domain Admins,CN=Users,DC=domain,DC=tld - CN=Enterprise Admins,CN=Users,DC=forestroot,DC=tld - CN=Schema Admins,CN=Users,DC=forestroot,DC=tld For each user object returned it parses the distinguishedName and walks up the OU chain. A member is considered compliant only when its DN sits under a dedicated administrative OU pattern (default OU=Tier-0,OU=Admin, configurable via -Tier0OU). The check also reads the gPLink attribute on every OU that contains a Tier-0 user, expands each linked GPO, and inspects the GPO security descriptor (nTSecurityDescriptor on the groupPolicyContainer object in CN=Policies,CN=System) to confirm that GPO edit rights are restricted to Tier-0 principals only. Finally it reads the Default Domain Controllers Policy and any GPO linked to the Tier-0 OU and verifies that a User Rights Assignment policy defining "Deny log on locally", "Deny log on through Remote Desktop Services", and "Deny access to this computer from the network" is applied to the Tier-0 group on all non-Tier-0 hosts.
Por qué importa
The Microsoft tiered administration model (formerly the Enhanced Security Administrative Environment) exists because credential exposure flows downhill. The moment a Domain Admin token, password hash, or Kerberos TGT lands on a workstation or a member server, an attacker with local SYSTEM on that host can lift it and use it. Co-locating Tier-0 accounts with general user accounts violates the model in three ways. First, every GPO linked above the shared OU applies to Domain Admins, so a Tier-1 helpdesk admin who can edit a logon-script GPO can plant a payload that runs in the context of a Domain Admin at next logon (T1484.001). Second, software installation and browser configuration policies push attacker controllable surface (extensions, MSI packages, proxy PAC URLs) into Tier-0 sessions. Third, GPO scoping cannot grant a "deny logon to workstations" policy cleanly when Tier-0 accounts are sprinkled across the user OU tree, so the accounts end up able to RDP or interactively log on to Tier-1 and Tier-2 hosts, where their credentials are then harvested with mimikatz sekurlsa::logonpasswords, Rubeus dump, or LSASS minidumps. The blast radius of any of these primitives is forest takeover.
Ruta de ataque
1. Reconnaissance: the attacker enumerates Domain Admins with PowerView (Get-DomainGroupMember -Identity "Domain Admins" -Recurse) or BloodHound (SharpHound -CollectionMethod Group,ACL,GPOLocalGroup). The DN of each admin is logged. 2. OU mapping: for every admin DN, the attacker walks up the OU chain and lists the gPLink attribute on each parent container with (Get-ADObject -Identity $ou -Properties gPLink).gPLink. 3. GPO edit rights: the attacker runs Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs and looks for any non-Tier-0 principal with WriteProperty, GenericAll, GenericWrite, or WriteDacl on a groupPolicyContainer that is linked above a Tier-0 user. BloodHound surfaces this as a GenericAll / GenericWrite edge to a GPO node with a path into a high-value user. 4. Payload staging: with edit rights on a qualifying GPO, the attacker uses SharpGPOAbuse (--AddComputerScript, --AddUserScript, --AddImmediateTask) or Group Policy Management Console to add a User Configuration logon script, scheduled immediate task, or Group Policy Preferences item that drops and executes a payload. 5. Trigger: at the next interactive logon by the Tier-0 user (or after gpupdate /force), the payload runs in the Tier-0 user context. The attacker captures the TGT or NTLM hash, performs DCSync, or adds themselves to Domain Admins. 6. Persistence: the attacker leaves the GPO in place. Because GPO changes are noisy but rarely reviewed retroactively, the backdoor often survives multiple credential rotations and incident response cycles. A parallel branch exists when Tier-0 accounts are allowed to log on interactively to Tier-1 or Tier-2 hosts because no logon-restriction GPO exists: the attacker compromises a workstation, waits for or coerces a Tier-0 logon (helpdesk ticket, RDP shadow, runas), and harvests credentials directly from LSASS.
Cómo lo evalúa Guerrilla
Guerrilla resolves the three forest-root groups via Get-ADGroupMember -Recursive, then for each member it reads distinguishedName and tests whether the DN matches the configured Tier-0 OU pattern (-Tier0OU, default OU=Tier-0,OU=Admin). Non-matching members are reported with their full DN and the parent OU. For each non-compliant parent OU the check reads gPLink and expands every linked GPO display name and GUID. For each linked GPO it binds to CN={GUID},CN=Policies,CN=System,DC=domain,DC=tld and walks the DACL, flagging any ACE on a non-Tier-0 trustee that grants WriteProperty, GenericAll, GenericWrite, or WriteDacl. The check also reads the User Rights Assignment section of GPOs linked to the Tier-0 OU (via the GptTmpl.inf in SYSVOL) and verifies SeDenyInteractiveLogonRight, SeDenyRemoteInteractiveLogonRight, and SeDenyNetworkLogonRight contain the Tier-0 group SID on non-DC hosts. Findings include the offending account DN, the parent OU, the inherited GPO list, and any GPO with non-Tier-0 edit rights.
Valor recomendado
All Domain Admins, Enterprise Admins, and Schema Admins members are in a dedicated Tier-0 OU (typically OU=Tier-0,OU=Admin) with restricted GPO authorship.
Remediación
Create OU=Tier-0,OU=Admin if it doesn't exist. Move all members of Domain/Enterprise/Schema Admins into it. Restrict the GPO authorship on that OU (only Tier-0 admins themselves). Apply a dedicated logon-restriction GPO so Tier-0 accounts can only log on to Tier-0 hosts. Block inheritance on the OU.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-3, AC-6
- CIS AD Benchmark
- 8.3.1
- MITRE ATT&CK
- T1078