The built-in groups nobody looks at
Jan 2nd, 2023 by Jesper Kråkhede
Last month I turned 50. I spent half of the day on a call with a small municipality that had been hit and couldn´t afford an incident responder. It wasn´t the birthday I had planned, but it was a good one. And it reminded me of something I see over and over: the built-in groups in Active Directory.
Microsoft´s guidance on securing Active Directory has been clear for years. Enterprise Admins and Schema Admins should be empty, and only get members temporarily when you actually need them. Domain Admins should be used for building the domain and for disaster recovery, not for daily work. The built-in Administrator account should be protected and seldom used. Account Operators, Server Operators, Print Operators and Backup Operators should preferably be empty, because their rights reach much further than their names suggest. A Backup Operator can read every file on a domain controller, including the database with all the password hashes.
Add your privileged accounts to Protected Users, and check what is in Pre-Windows 2000 Compatible Access while you are at it.
At the municipality, like at so many others, these groups had grown over twenty years. Old service accounts, consultants who left long ago, and a few people who were added ‘just for a moment’. Not out of carelessness. There was simply nobody with time to look.
Empty groups can´t be abused.