Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000191

Persistent membership detected in Active Directory Schema Admins group

High
Active Directory
Defense Evasion Persistence Privilege Escalation
v8

Signature Identity

CTD-000191
Threat ID
8
Version
IOE
Indicator Type

Threat Description

The Schema Admins group holds forest-wide privileges that allow modification of the Active Directory schema which is one of the most sensitive operations in an AD environment. Members can create or alter object classes and attributes, potentially introducing unauthorized or malicious schema changes.

Persistent membership in the Schema Admins group significantly increases the risk of privilege escalation and long-term persistence by threat actors. Best practice is to keep this group empty under normal conditions and grant only temporary membership during controlled operations (e.g., schema extensions or directory upgrades), then remove access immediately after completion.

MITRE ATT&CK: Attack Tactics

Defense Evasion Persistence Privilege Escalation

D3FEND: Defend Tactics

D3-ACH (Application Configuration Hardening)

Remediation

  1. Open Active Directory Users and Computers (ADUC):
    • Press Win + R.
    • Type dsa.msc.
    • Press Enter.
  2. Enable Advanced Features:
    • In ADUC, open the View menu.
    • Select Advanced Features.
  3. In the forest root domain, navigate to the Users container and locate the Schema Admins group.
  4. Right-click Schema Admins and choose Properties.
  5. Open the Members tab and review current membership.
  6. Remove any accounts that are not required for an active, approved schema modification.
  7. Click OK to save changes.
  8. Keep the Schema Admins group empty by default and grant only temporary, time-bound membership when performing schema extensions or upgrades.

Frequently Asked Questions

What does Persistent membership detected in Active Directory Schema Admins group mean?

When an account is granted permanent membership to the Schema Admins group, it gains forest-wide privileges for modifying the Active Directory schema. This allows the account to create or alter object classes and attributes without proper authorization.

This condition enables attackers to introduce unauthorized schema changes, leading to privilege escalation and long-term persistence. The attacker gains the capability to modify the Active Directory schema, which can be used for reconnaissance, lateral movement, or as a pivot point for further attacks.

An attacker with persistent membership in the Schema Admins group can use their elevated privileges to introduce malicious schema changes or escalate their privileges further, potentially leading to long-term persistence and increased risk of compromise. This capability supports later attacker activity by providing a means for reconnaissance, lateral movement, or as a pivot point for further attacks.

Cayosoft Guardian continuously monitors group membership across the Active Directory environment domain and flags permanent membership in the Schema Admins group as a security issue, alerting administrators to potential risks.

Cayosoft Guardian alerts administrators to remove unnecessary accounts from the Schema Admins group, keeping the group empty under normal conditions and limiting the risk of unauthorized schema modifications and privilege escalation. This helps provide visibility into group membership changes and supports investigation by showing change history.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Forest-wide Privileged Access Management
Attack Tactics
Defense Evasion Persistence Privilege Escalation
Defend Tactics
D3-ACH (Application Configuration Hardening)
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical