Audit Privileged Groups and AdminSDHolder in Active Directory

Why this lab matters

An attacker who reaches one Domain Admin account owns the domain. So the number of accounts with that level of access, and the state they are in, is the most important number in an Active Directory security review. It is nearly always higher than the team believes.

What you need

• A lab domain. Any Windows Server evaluation in a virtual machine promoted to a domain controller will do.
• A machine with the Active Directory PowerShell module (RSAT) and an account that can read the directory. Changes in Steps 4 and 5 need Domain Admin rights.
• Test data: create a few users, add some to Domain Admins directly and one through a nested group, then remove one again.

Step 1: Expand every privileged group

Import-Module ActiveDirectory

$groups = 'Domain Admins','Enterprise Admins','Schema Admins','Administrators',
          'Account Operators','Backup Operators','Server Operators','Print Operators',
          'DnsAdmins','Group Policy Creator Owners'

$members = foreach ($g in $groups) {
  try {
    Get-ADGroupMember -Identity $g -Recursive | Where-Object objectClass -eq 'user' |
      ForEach-Object { [pscustomobject]@{ Group = $g; Sam = $_.SamAccountName; DN = $_.DistinguishedName } }
  } catch { Write-Warning "Could not read $g" }
}
$members | Group-Object Group | Select-Object Name, Count
$admins = $members | Sort-Object Sam -Unique

Compare the counts with what your team expected. The operator groups are often forgotten, yet Account Operators and Backup Operators can each be used to take over a domain.

Step 2: Flag risky admin accounts

$cut = (Get-Date).AddDays(-90)
$detail = $admins | ForEach-Object {
  Get-ADUser $_.Sam -Properties LastLogonTimestamp, PasswordLastSet, PasswordNeverExpires,
                                 ServicePrincipalName, Enabled, DoesNotRequirePreAuth, TrustedForDelegation
} | Select-Object SamAccountName, Enabled,
    @{n='LastLogon';e={[datetime]::FromFileTime($_.LastLogonTimestamp)}},
    PasswordLastSet, PasswordNeverExpires,
    @{n='HasSPN';e={[bool]$_.ServicePrincipalName}},
    DoesNotRequirePreAuth, TrustedForDelegation

$detail | Where-Object { $_.LastLogon -lt $cut -or $_.PasswordNeverExpires -or $_.HasSPN -or -not $_.Enabled } |
  Format-Table -AutoSize
$detail | Export-Csv .\privileged-accounts.csv -NoTypeInformation

Flag	Why it matters
No logon in 90 days	Unused access that nobody would miss, or notice being abused
Password never expires	Old passwords are more likely to be in a breach list
Has an SPN	The account can be Kerberoasted. Admins should never have one
Disabled but still a member	Re-enabling it restores full admin rights at once
Does not require pre-authentication	Open to AS-REP roasting

Step 3: Find orphaned adminCount accounts

A background process called SDProp runs every 60 minutes on the PDC emulator. It stamps adminCount = 1 on members of protected groups and replaces their permissions with the template on the AdminSDHolder object. When an account leaves the group, nothing reverses that. The account keeps blocked inheritance and often keeps delegated rights nobody intended.

$flagged = Get-ADUser -LDAPFilter '(adminCount=1)' -Properties adminCount
$orphans = $flagged | Where-Object { $_.SamAccountName -notin $admins.Sam -and $_.SamAccountName -ne 'krbtgt' }
$orphans | Select-Object SamAccountName, DistinguishedName

Step 4: Clean up

1. Remove stale and unneeded accounts from the groups:

   Remove-ADGroupMember -Identity 'Domain Admins' -Members 'old.admin' -Confirm:$false

2. For each orphan, clear the flag:

   Set-ADUser 'former.admin' -Clear adminCount

3. Re-enable permission inheritance on the orphan. In Active Directory Users and Computers turn on Advanced Features, open the account, then Security, Advanced, Enable inheritance.

Step 5: Add real admins to Protected Users

Members of Protected Users cannot authenticate with NTLM, cannot use DES or RC4 for Kerberos, cannot be delegated and get a four hour ticket lifetime.

Add-ADGroupMember -Identity 'Protected Users' -Members 'adm.jsmith'
Get-ADGroupMember 'Protected Users' | Select-Object SamAccountName

Evidence to keep

• The before and after CSV files and group counts.
• The list of accounts removed, with the approver for each.
• Protected Users membership after the change.