Lesson 1.11: Privileged groups and nested membership
A handful of groups control an AD domain: Domain Admins, Enterprise Admins, Administrators and some 'operator' groups. The problem is rarely the direct members you can see, but nesting: a group inside a group inside Domain Admins quietly makes its members domain administrators. In the lab you list Domain Admins' direct members, then expand membership transitively and discover that two helpdesk staff are domain administrators through two layers of nesting, confirm it with adminCount, and remove the nesting with ldapmodify.
17 min
You will learn to
- Name the most privileged AD groups
- List direct group members
- Expand nested membership transitively
- Use adminCount as a signal
- Remove a nested group with ldapmodify
Key terms
- Domain Admins
- Full control of the domain and every joined machine.
- Operator groups
- Built-in groups like Backup Operators, Account Operators, Server Operators and Print Operators that can lead to full control.
- Nested group
- A group that is a member of another group; its members inherit the outer group's rights.
- adminCount / AdminSDHolder
- AD marks members of protected groups with adminCount=1 and resets their permissions from the AdminSDHolder template every hour.
- LDAP_MATCHING_RULE_IN_CHAIN
- OID 1.2.840.113556.1.4.1941: a filter that follows group nesting to any depth.
← Anatomy of a web application · All lessons · Where the logs live →