Last month I turned 50. I spent half of the day on a call with a small municipality that had been hit and couldn\u00b4t afford an incident responder. It wasn\u00b4t the birthday I had planned, but it was a good one. And it reminded me of something I see over and over: the built-in groups in Active Directory.<\/p>\n
Microsoft\u00b4s guidance on securing Active Directory has been clear for years. Enterprise Admins and Schema Admins should be empty, and only get members temporarily when you actually need them. Domain Admins should be used for building the domain and for disaster recovery, not for daily work. The built-in Administrator account should be protected and seldom used. Account Operators, Server Operators, Print Operators and Backup Operators should preferably be empty, because their rights reach much further than their names suggest. A Backup Operator can read every file on a domain controller, including the database with all the password hashes.<\/p>\n
Add your privileged accounts to Protected Users, and check what is in Pre-Windows 2000 Compatible Access while you are at it.<\/p>\n
At the municipality, like at so many others, these groups had grown over twenty years. Old service accounts, consultants who left long ago, and a few people who were added \u2018just for a moment\u2019. Not out of carelessness. There was simply nobody with time to look.<\/p>\n
Empty groups can\u00b4t be abused.<\/p>\n","protected":false},"excerpt":{"rendered":"
Last month I turned 50. I spent half of the day on a call with a small municipality that had been hit and couldn\u00b4t afford an incident responder. It wasn\u00b4t the birthday I had planned, but it was a good one. And it reminded me of something I see over and over: the built-in groups […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[55,116,47],"class_list":["post-1363","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-active-directory","tag-built-in-groups","tag-privileged-access"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1363","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1363"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1363\/revisions"}],"predecessor-version":[{"id":1388,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1363\/revisions\/1388"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1363"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1363"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1363"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}