Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000172

Active Directory object granted sensitive user rights by a GPO

High
Active Directory
Defense Evasion Persistence Privilege Escalation

Signature Identity

CTD-000172
Threat ID
Version
IOC-IOE
Indicator Type

Threat Description

User rights assignments in a Group Policy Object (GPO) control powerful privileges, such as Act as part of the operating system, Debug programs, and Back up files and directories, on every computer that the GPO applies to. When a GPO linked in your Active Directory domain grants these rights to users, groups, or service accounts other than trusted principals such as Administrators or SYSTEM, every targeted computer, including domain controllers, gives those principals the same privileges. A threat actor who compromises one of these accounts can use the rights to escalate privileges, establish persistence, impersonate other accounts, or bypass authentication, which can lead to complete domain compromise.

Example: To troubleshoot a service, an administrator adds a help desk group to Debug programs in a GPO linked to the Domain Controllers organizational unit. A threat actor compromises a help desk member’s account, signs in to a domain controller, uses the debug privilege to read the memory of the LSASS process, and extracts the credentials of a domain administrator.

MITRE ATT&CK: Attack Tactics

Defense Evasion Persistence Privilege Escalation

D3FEND: Defend Tactics

D3-APA (Access Policy Administration)

Remediation

Remove nonstandard security principals from sensitive user rights in the GPO reported in the evidence, and then enforce least privilege with a dedicated domain controller baseline GPO.

  1. On a computer that has the Group Policy Management Console installed, open Group Policy Management.
  2. Expand Forest, Domains, your domain, and then Group Policy Objects.
  3. Right-click the GPO reported in the evidence, and then select Edit.
  4. In Group Policy Management Editor, go to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
  5. Double-click the user right reported in the evidence.
  6. Select each unauthorized security principal, and then select Remove.
  7. Select OK.
  8. Optional: To apply the change right away, run gpupdate /force on the affected computers.

To detect future misuse, enable the Audit Sensitive Privilege Use and Audit Authorization Policy Change audit policies on domain controllers.

More information:User Rights Assignment

Frequently Asked Questions

What does Active Directory object granted sensitive user rights by a GPO mean?

Active Directory objects, such as users, groups, or service accounts, are assigned powerful privileges, like Act as part of the operating system, Debug programs, and Back up files and directories, through a Group Policy Object (GPO).

When non-trusted principals are granted sensitive user rights through a GPO, it can lead to privilege escalation and defense evasion, as attackers can use the assigned privileges to escalate privileges or bypass authentication.

Attackers can exploit Active Directory object granted sensitive user rights by a GPO by using the assigned privileges to escalate privileges or bypass authentication, ultimately leading to domain compromise.

Cayosoft Guardian continuously monitors for Active Directory object granted sensitive user rights by a GPO and alerts administrators when the condition is detected. This provides visibility into the exposure so security teams can review the finding and determine whether investigation or response is required. Guardian monitors Active Directory for this condition and flags it when detected.

Cayosoft Guardian helps reduce the risk of Active Directory object granted sensitive user rights by a GPO by alerting administrators when the condition is detected and providing visibility into the affected accounts, groups, permissions, and configurations. This helps security teams identify exposure more quickly and respond before the issue contributes to a larger security event.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Infrastructure Privileged Access Management
Attack Tactics
Defense Evasion Persistence Privilege Escalation
Defend Tactics
D3-APA (Access Policy Administration)
Indicator Types
IOC IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical