Home > Access > Privileged Access

Privileged Access in Active Directory


Privileged access in Active Directory, i.e. the proverbial Keys to the Kingdom, is the most powerful access that one can possess in an Active Directory based IT infrastructure operating on the Microsoft Windows Server platform.


What constitutes privileged access in Active Directory

The ability to enact any of the following 10 operations in Active Directory constitutes possessing privileged access in Active Directory -

  1. Create a new domain or a new Domain Controller (DC) in an Active Directory forest

  2. Manage (or have unrestricted access to) any DC in an Active Directory forest

  3. Obtain a copy of the NTDS.dit database file from any DC in an Active Directory forest

  4. Backup or restore (or obtain a copy of) a backup of any domain in an Active Directory forest

  5. Replicate secrets (credentials) from any domain in an Active Directory forest

  6. Create or modify any external or forest trust relationship in an Active Directory forest

  7. Manage or modify the Schema or Configuration partitions in an Active Directory forest

  8. Manage or modify the default Domain policy or the default Domain Controllers Policy in any domain in an Active Directory forest

  9. Change the access specified on, or the ownership of, the AdminSDHolder object in any domain -OR- on any partition (Domain, Config, Schema) root object in an Active Directory forest

  10. Control or manage* any security principal (i.e. account or group) that can enact any of the above operations in an Active Directory environment

    11. * i.e. - Anyone who has sufficient Active Directory Effective Permissions to be able to i) change permissions on, ii) change ownership of, iii) reset the password of (or modify the UPN of) or iv) modify the group membership of any such account or group,
               or v) change the userAccountControl attribute on any such account and have them be trusted for unconstrained delegation, or vi) change the User Principal Name (UPN) attribute on any such accounts, or vii) add their own account to a group.
               Finally, by extension, ALSO anyone who has administrative (unrestricted) access over any machine on to which any such account logs on -OR- anyone who can modify the group policy linked to the machine on which any such account logs on


+ If an organization utilizes Active Directory Certificate Services (AD CS) for client or server authentication, anyone who can manage the AD CS deployment should also be considered to have privileged access in Active Directory.


Note - The list above specifies what constitutes unrestricted privileged access in Active Directory. In addition to unrestricted access, there also exists restricted privileged access in Active Directory in the form of administrative delegation.




How to identify who has (unrestricted) privileged access in Active Directory

To identify who has (unrestricted) privileged access in Active Directory, one needs to determine who can enact the following 10 operations in Active Directory -

#
.		 Operation
.		 Access Required
.		 Notes
.
1
Create a new domain or a new Domain Controller (DC) in an Active Directory forest
Members of the Enterprise Admins group can create new domains in Active Directory.
Members of the Domain Admins group can create a new DC in an Active Directory domain
2
Manage (or have unrestricted access to) any DC in an Active Directory forest
Anyone who has the following combinaton of user rights/privileges in the default Domain Controllers policy can manage DCs -
{ Allow log on locally OR Allow log on through Remote Desktop Services } + { Any of the 13 sensitive user rights/privileges }
3
Obtain a copy of the NTDS.dit database file from any DC in an Active Directory forest
Anyone who has the following combination of user rights/privileges in the default DC policy and file-system effective access can manage DCs -
{ Allow log on locally } + { sufficient file-system effective access to access and copy the NTDS.dit file }

Note - To be able to copy the NTDS.dit file, the DC needs to be started in Directory Services Restore Mode (, so Restore Mode Admin password is required.)

4
Backup or restore a backup of any domain in an Active Directory forest
Anyone with the following user rights/privileges in the default DC policy can backup Active Directory - { Allow log on locally } + { Backup files and directories }
Anyone with the following user rights/privileges in the default DC policy can restore Active Directory - { Allow log on locally } + { Restore files and directories }

5
Replicate secrets (credentials) from any domain in an Active Directory forest
Anyone with the following directory services effective access on the domain root object can replicate secrets from an Active Directory domain -
Active Directory Effective Permissions – { Extended Right - Get Replication Changes } and { Extended Right - Get Replication Changes All }

6
Create or modify any external or forest trust relationship in an Active Directory forest
Anyone with the following directory services effective access on the System container can create trust relationships -
Active Directory Effective Permissions – { Create Child - trustedDomain }

Anyone with the following directory services effective access on Trusted Domain objects in the System container can modify trust relationships -
Active Directory Effective Permissions – { Write Property - trustAttributes } or { Write Property - trustDirection } or { Write Property - trustType }

7
Manage or modify the Schema or Configuration partitions in an Active Directory forest
Anyone with the following directory services effective access on the Schema partition root can manage the Schema -
Active Directory Effective Permissions – { Modify Permissions } or { Modify Owner }

Anyone with the following directory services effective access on the Configuration partition root can manage the Configuration partition -
Active Directory Effective Permissions – { Modify Permissions } or { Modify Owner }

Note - Strictly speaking, changes can also be made by anyone with sufficient Active Directory Effective Permissions to modify various objects in the partition

8
Manage or modify the default Domain policy or the default Domain Controllers Policy in any domain in an Active Directory forest
Members of the Administrators group can modify the default Domain policy and/or the default Domain Controllers Policy in their domain
9
Change the access specified on, or the ownership of, any partition (Domain, Config, Schema) root object in an Active Directory forest
Anyone with the following directory services effective access on the domaint root can manage a Domain -
Active Directory Effective Permissions – { Modify Permissions } or { Modify Owner }

Anyone with the following directory services effective access on the Schema partition root can manage the Schema -
Active Directory Effective Permissions – { Modify Permissions } or { Modify Owner }

Anyone with the following directory services effective access on the Configuration partition root can manage the Configuration partition -
Active Directory Effective Permissions – { Modify Permissions } or { Modify Owner }

10
Control or manage any security principal (i.e. account or group) that can enact any of the above operations in an Active Directory environment
User Account Management Operations -

1. Reset a domain user account's password - Sufficient { Extended Right - Reset Password } Active Directory Effective Permissions
2. Modify permissions on a domain user account - Sufficient { Modify Permissions } Active Directory Effective Permissions
3. Modify ownership of a domain user account - Sufficient { Modify Owner } Active Directory Effective Permissions
4. Modify Kerberos delegation settings on a domain user account - Sufficient { Write Property - userAccountControl } Active Directory Effective Permissions
5. Modify User Principal Name of a domain user account - Sufficient { Write Property - userPrincipalName } Active Directory Effective Permissions


Security Group Management Operations -

1. Change a security group's membership - Sufficient { Write Property - member } Active Directory Effective Permissions
2. Add/remove one's own account to/from a security group - Sufficient { Extended Right - Add/remove Self as Member } Active Directory Effective Permissions
3. Modify permissions on a domain security group - Sufficient { Modify Permissions } Active Directory Effective Permissions
4. Modify ownership of a domain security group - Sufficient { Modify Owner } Active Directory Effective Permissions


Note - The table above describes how to assess who has what unrestricted privileged access in Active Directory, To assess who has restricted privileged access in Active Directory, see how to assess administrative delegations in Active Directory.




Default (unrestricted) privileged access in Active Directory

It is (only) by virtue of the above that the following accounts and groups (happen to) possess (unrestricted) privileged access by default in Active Directory -

  1. Administrator account - This is the default administrator account in Active Directory. It is a member of several default admin groups, including Administrators, Enteprise Admins, Domain Admins, Schema Admins and Group Policy Creator Owners.

    2. Note - Albeit membership in these various default admin groups gives it automatic unrestricted access domain-wide, strictly speaking, its membership in the Administrators group is sufficient for it to possess unrestricted access, as it gets the Take ownership of files or other objects privilege on DCs from it.

  2. krbtgt account - This is the service account used by the Key Distribution Center (KDC) service. The password of this unique account is used to derive a cryptographic key that is subsequently used for encrypting and decrypting issued TGTs.

  3. Administrators group - This is the most powerful administrative group in Active Directory, primarily because it (is the only group that is) granted several powerful privileges, such as Take ownership of files or other objects and others, by default.

  4. Schema Admins group - Members of this group have privileged access by virtue of being granted full control over the Active Directory Schema by default, and can thus enact operation 7 above, i.e. they can manage and modify the Schema.

  5. Enterprise Admins group - Members of this group have unrestricted privileged access forest-wide by virtue of being granted full control over all partitions in an Active Directory forest by default, and can consequently enact all operations above.

  6. Domain Admins group - Members of this group have unrestricted privileged access domain-wide in their resective domains by virtue of being granted full control over their respective domain partitions in an Active Directory forest by default.

  7. Backup Operators group - Members of this group possess privileged access because this group is granted sufficient privileges by default so as to be able to log on to Domain Controllers and perform an Active Directory backup or restore.

  8. Print Operators group - Members of this group only possess privileged access because this group is granted sufficient privileges by default so as to be able to log on to Domain Controllers and load and unload device drivers on them.

  9. Server Operators group - Members of this group only possess privileged access because this group is also granted sufficient privileges by default so as to be able to log on to Domain Controllers and perform an Active Directory backup or restore.

  10. Account Operators group - Members of this group only possess privileged access because this group is explicitly granted full control (in ACLs) on all* domain user accounts, computer accounts and security groups in Active Directory by default.

    11. Note - As an exception, Account Operators do not possess such control on administrative accounts and groups that are protected by AdminSDHolder. Also worthy of mention is the fact that Account Operators can logon locally on to DCs.

  11. Key Admins group - Members of this group possess privileged access because this group is granted full control on the Keys container and access to modify the ms-DS-Key-Credential-Link attribute on all user accounts in a domain by default.

  12. Enterprise Key Admins group - Members of this group possess privileged access because this group is granted full control on the Keys container and access to modify the ms-DS-Key-Credential-Link attribute on all user accounts in all domains by default.

  13. Incoming Forest Trust Builders group - Members of this group possess privileged access because this group is granted sufficient access to create inbound forest trusts, via the Create Inbound Forest Trust extended right on the domain root.

  14. Domain Controllers group - Members of this group possess privileged access because they are the computer accounts of all Domain Controllers in a domain i.e. the system inserts this SID in the access token of every DC's domain computer account.

    15. Note - This group is intended to only contain the computer accounts of all DCs of a domain as members. However, Active Directory does not seem to restrict its membership from being modified i.e. any security principal can be added to its membership by anyone with sufficient effective access.

  15. Read-only Domain Controllers group - Members of this group possess privileged access because they are the computer accounts of all Read-only DCs in a domain i.e. the system inserts this SID in the access token of every read-only DC's account.

    16. Note - This group is intended to only contain the computer accounts of all read-only DCs of a domain as members. However, Active Directory does not seem to restrict its membership from being modified i.e. any security principal can be added to its membership by anyone with sufficient effective access.