Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000104

AD computer account that is a member of privileged groups

Critical
Active Directory
Lateral Movement Persistence
v30

Signature Identity

CTD-000104
Threat ID
30
Version
IOC
Indicator Type

Threat Description

A threat actor might compromise an AD computer to be able to act as a member of that group.

NOTE: Cayosoft Guardian considers both direct and indirect (nested) group permissions when evaluating risks. Privileged users are defined in Active Directory as users with adminCount=1. By design, Active Directory uses this attribute to protect members of administrative groups.

According to security best practices, it is not recommended to reuse admin accounts; instead, these accounts must be de-provisioned. If an account has administrative permissions, it may also gain access to other resources using these permissions and retain this access even after it is removed from the administrative groups. Learn more about AdminSdHolder and SDProp – Microsoft Community Hub.

MITRE ATT&CK: Attack Tactics

Lateral Movement Persistence

D3FEND: Defend Tactics

Domain Account Monitoring

Remediation

To remove a group member in Active Directory using Active Directory Users and Computers (ADUC), follow these step-by-step instructions: 

  1. Open ADUC.
  2. Expand the Domain node and navigate to the OU (Organizational Unit) containing the group from which you want to remove a member.
  3. Locate the group from which you want to remove the member and double-click on it to open its properties.
  4. Inside the group’s properties window, go to the Members tab.
  5. Find and Select the Member to remove.
  6. Once the member is selected, click the Remove or Remove from Group button (usually located near the member list).
  7. A confirmation dialog box will appear asking if you are sure you want to remove the member from the group. Click Yes to confirm.
  8. Check the member list to ensure the specific user has been removed from the group.

Frequently Asked Questions

What does AD computer account that is a member of privileged groups mean?

An Active Directory computer account has been compromised, allowing it to join one or more administrative groups. This grants the attacker membership in those groups, providing elevated privileges and access to sensitive resources through Group Policy Objects (GPOs) and other administrative tools.

This threat is rated critical because it enables attackers to maintain persistence within the environment, move laterally across the domain, and escalate privileges. With this level of access, an attacker can steal credentials, compromise other systems, and perform reconnaissance on sensitive resources.

Attackers can use a compromised AD computer account in a privileged group to gain elevated access to sensitive resources through Group Policy Objects (GPOs) and other administrative tools. This allows them to move laterally across the domain, maintain persistence, escalate privileges, steal credentials, and compromise other systems within the environment.

Cayosoft Guardian continuously monitors Active Directory for changes to group membership and privilege assignments. When an unauthorized change is detected, Guardian flags the issue so administrators can investigate and remediate.

Cayosoft Guardian provides real-time visibility into group membership and privilege assignments. This allows administrators to quickly identify and remediate unauthorized changes, preventing attackers from gaining elevated access to sensitive resources.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Account protection Privileged Access Management
Attack Tactics
Lateral Movement Persistence
Defend Tactics
Domain Account Monitoring
Indicator Types
IOC
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical