AdminSDHolder, the template attackers love
Feb 14th, 2023 by Jesper Kråkhede
Let´s talk about one of the more obscure objects in Active Directory: AdminSDHolder.
AdminSDHolder is a container in the System part of the domain. Its permissions work as a template. Every hour or so a process on the domain controller holding the PDC emulator role, called SDProp, goes through all members of the protected groups, like Domain Admins, Enterprise Admins, Administrators and the operator groups. It overwrites their permissions with the ones on AdminSDHolder. The idea is good: if someone changes the permissions on an admin account, they are automatically reset.
Now think like an attacker. If you have Domain Admin for a short while and want to keep your access, add a permission for an account you control to AdminSDHolder. Within an hour SDProp copies it to every protected account. The defenders can clean up the admin accounts as much as they like, and an hour later your permission is back. Many teams don´t even know the object exists, let alone check it.
So, during an incident, always check the permissions on AdminSDHolder against a known good baseline. Monitor changes to it with directory service auditing. Defender for Identity and similar tools can alert on it. And check the adminCount attribute on accounts, which tells you which accounts have been touched by SDProp, even if they are no longer in a protected group.
It is one object. It takes five minutes to check, if you know it is there.