Regular AD object with unexpected admincount value

A regular user account or group with an AdminCount attribute set to any value might indicate potential threat activities. In particular, accounts with AdminCount=1 do not inherit permissions from parent containers. Active Directory employs the AdminSDHolder object, protected groups, and the Security Descriptor Propagator (SDProp) to safeguard privileged users and groups. SDProp is a process that runs every 60 minutes by default on the domain controller hosting the domain’s PDC Emulator (PDCE). During this process, SDProp compares the permissions on the domain’s AdminSDHolder object with those on the protected accounts and groups. If there is a discrepancy, SDProp resets the permissions on the protected accounts and groups to match those of the AdminSDHolder object.

An unexpected AdminCount value in a regular object may indicate potential threat activities. User accounts with previous administrative permissions should not be reused and should be deprovisioned.

NOTE: Cayosoft Guardian considers both direct and indirect (nested) group permissions when evaluating risks. Privileged groups are defined in Active Directory as groups with adminCount=1 and a well-known Security Identifier (SID). Any potential target objects are identified as members (including indirect ones) of previously identified built-in privileged groups. By design, Active Directory uses this attribute to protect members of administrative groups.

According to security best practices, it is not recommended to reuse admin accounts; instead, these accounts must be de-provisioned. If an account has administrative permissions, it may also gain access to other resources using these permissions and retain this access even after it is removed from the administrative groups. Learn more about AdminSdHolder and SDProp – Microsoft Community Hub.