ukJ231Hd

1notes-active-directory
2
3ACTIVE DIRECTORY .NET
4• Get the Current Domain:
5• [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().Name
6• [System.DirectoryServices.ActiveDirectory.Domain]::GetComputerDomain().Name
7• Get the Computer’s Site:
8• [System.DirectoryServices.ActiveDirectory.ActiveDirectorySite]::GetComputerSite()
9• List All Domain Controllers in a Domain:
10• [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().DomainControllers
11• Get Active Directory Domain Mode:
12• [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().DomainMode
13• List Active Directory FSMOs:
14• ([System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()).SchemaRoleOwner
15• ([System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()).NamingRoleOwner
16• ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).InfrastructureRoleOwner
17• ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).PdcRoleOwner
18• ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).RidRoleOwner
19• Get Active Directory Forest Name:
20• [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().Name
21• Get a List of Sites in the Active Directory Forest:
22• [array] $ADSites = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().Sites
23• Get Active Directory Forest Domains:
24• [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().Domains
25• Get Active Directory Forest Global Catalogs:
26• [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().GlobalCatalogs
27• Get Active Directory Forest Mode:
28• [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().ForestMode
29• Get Active Directory Forest Root Domain:
30• [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().RootDomain
31
32POWERSHELL ACTIVE DIRECTORY MODULE
33• Requires AD Web Services (ADWS) running on targeted DC (TCP 9389)
34• Get-ADDomainController –Discover –Service “ADWS”
35• SOAP XML message(s) over HTTP translated on DC
36• PowerShell AD Cmdlet Example:
37• Import-module ActiveDirectory
38• $UserID = “JoeUser”
39• Get-ADUser $UserID –property *
40
41PS C:\temp> import-module servermanager ; add-windowsfeature rsat-ad-powershell
42
43FINDING USEFUL AD COMMANDS
44• Get-Module -ListAvailable
45• Get-Command -module ActiveDirectory
46• PowerShell AD Module Cmdlets:
47• Windows Server 2008 R2: 76 cmdlets
48• Windows Server 2012: 135 cmdlets
49• Windows Server 2012 R2: 147 cmdlets
50
51POPULAR CMDLETS: WINDOWS SERVER 2008 R2
52• Get/Set-ADForest
53• Get/Set-ADDomain
54• Get/Set-ADDomainController
55• Get/Set-ADUser
56• Get/Set-ADComputer
57• Get/Set-ADGroup
58• Get/Set-ADGroupMember
59• Get/Set-ADObject
60• Get/Set-ADOrganizationalUnit
61• Enable-ADOptionalFeature
62• Disable/Enable-ADAccount
63• Move-ADDirectoryServerOperationMasterRole
64• New-ADUser
65• New-ADComputer
66• New-ADGroup
67• New-ADObject
68• New-ADOrganizationalUnit
69
70(SOME) NEW CMDLETS: WINDOWS SERVER 2012+
71• *-ADResourcePropertyListMember
72• *-ADAuthenticationPolicy
73• *-ADAuthenticationPolicySilo
74• *-ADCentralAccessPolicy
75• *-ADCentralAccessRule
76• *-ADResourceProperty
77• *-ADResourcePropertyList
78• *-ADResourcePropertyValueType
79• *-ADDCCloneConfigFile
80• *-ADReplicationAttributeMetadata
81• *-ADReplicationConnection
82• *-ADReplicationFailure
83• *-ADReplicationPartnerMetadata
84• *-ADReplicationQueueOperation
85• *-ADReplicationSite
86• *-ADReplicationSiteLink
87• *-ADReplicationSiteLinkBridge
88• *-ADReplicationSubnet
89• *-ADReplicationUpToDatenessVectorTable
90• Sync-ADObject
91
92ACTIVE DIRECTORY DISCOVERY:
93PS C:\windows\system32\ get-adrootdse
94PS C:\windows\system32\ get-adforest
95PS C:\windows\system32\ get-addomain
96PS C:\windows\system32\ get-ADDomainController
97PS C:\windows\system32\ get-adcomputer adsdc05
98
99QUICK AD COMPUTER COUNT
100$Time = (Measure-Command ` {[array] $AllComputers = Get-ADComputer -filter * -properties Name,CanonicalName,Enabled,passwordLastSet,SAMAccountName,LastLogonTimeStamp,DistinguishedName,OperatingSystem }).TotalMinutes
101$AllComputersCount = $AllComputers.Count
102Write-Output “There were $AllComputersCount Computers discovered in $DomainDNS in $Time minutes… `r “
103 
104 Get-Aduser
105 PS C:\windows\system32> get-aduser “jamsom”
106Get-ADUser -Filter * -Property
107• Created
108• Modified
109• CanonicalName
110• Enabled
111• Description
112• LastLogonDate
113• DisplayName
114• AdminCount
115• SIDHistory
116• PasswordLastSet
117• PasswordNeverExpires
118• PasswordNotRequired
119• PasswordExpired
120• SmartcardLogonRequired
121• AccountExpirationDate
122• LastBadPasswordAttempt
123• msExchHomeServerName
124• CustomAttribute1 - 50
125• ServicePrincipalName
126
127 Get-ADComputer
128 Get-ADComputer -Filter * -Property
129• Created
130• Modified
131• Enabled
132• Description
133• LastLogonDate (Reboot)
134• PrimaryGroupID
135(516 = DC)
136• PasswordLastSet
137(Active/Inactive)
138• CanonicalName
139• OperatingSystem
140• OperatingSystemServicePack
141• OperatingSystemVersion
142• ServicePrincipalName
143• TrustedForDelegation
144• TrustedToAuthForDelegation
145
146 Get-ADGROUP
147 PS C:\windows\sytem32> get-adgroup “Administrators”
148 PS C:\windows\sytem32> get-adgroupmember “Administrators”
149
150Groups with DC Logon Rights (default)
151•Account Operators
152•DC Backup Operators
153•DC Print Operators
154•DC Remote Desktop Users (RDP)
155•DC Server Operators
156
157ENUMERATE DOMAIN TRUSTS
158PS C:\windows\system32> $DomainDNS = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().Name
159[array]$ADDoainTrusts = Get-ADObject - Filter {ObjectClass -eq “trustedDomain”} - Properties *
160[int]$ADDomainTrustsCount = $ADDomaininTrusts.Count
161
162Write-Output “Discoverd $ADDomainTrustsCount Trust(s) in $DomainDNS `r”
163$ADDomainTrusts | select Name,Created,FlatName,instanceType,trustAttributes,trustDirection,securityIdentifier | format-table -autoSize
164
165GET AD SITES
166PS C:\windows\system32? $ADSites = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().sites
167[int]$ADSitesCount = $ADSites.Count
168Write-Output “There are $ADSitesCount AD Sites `r”
169$ADSites | select-object Name,Domains,Subnets,AdjacentSites,SiteLinks | format-table -AutoSize
170
171BACKUP DOMAIN GPOS… FOR FREE!
172Import-module GroupPolicy
173Backup-GPO –All –Domain “mlab.adsecurity.org” –Path “c:\GPOBackup”
174
175FINDING SERVICE ACCOUNTS
176PS C:\windows\system32> Get-ADUser -filter {ServicePrincipalName -like “*”} -property serviceprincipalname
177
178==> https://github.com/PyroTek3/PowerShell-AD-Recon/blob/master/Find-PSServiceAccounts
179
180DISCOVERING SERVICES IN AD WITH SPNS: SQL
181
182PS C:\windows\system32> get-adobject -filter {ServicePrincipalName -like “SQL” } -Properties Name,userPrincipalName,servicePrincipalName
183
184==> Active Directory SPN Directory:
185http://adsecurity.org/?page_id=183
186https://github.com/PyroTek3/PowerShell-AD-Recon/blob/master/Discover-PSMSSQLServers
187
188“SPN Scanning”: Service Discovery
189 • SQL servers, instances, ports, etc.
190    â—¦ MSSQLSvc/adsmsSQLAP01.adsecurity.org:1433
191 • Exchange
192    â—¦ exchangeMDB/adsmsEXCAS01.adsecurity.org
193 • RDP
194    â—¦ TERMSERV/adsmsEXCAS01.adsecurity.org
195 • WSMan/WinRM/PS Remoting
196   â—¦ WSMAN/adsmsEXCAS01.adsecurity.org
197 • Hyper-V Host
198    - Microsoft Virtual Console Service/adsmsHV01.adsecurity.org
199 - VMWare VCenter
200   - STS/adsmsVC01.adsecurity.org
201
202SPN Directory:
203http://adsecurity.org/?page_id=183 
204• Cracking Service Account Passwords (Kerberoast)
205- Request/Save TGS service tickets & crack offline.
206- “Kerberoast” python-based TGS password cracker
207- No elevated rights required!
208- No traffic sent to target!
209
210Reference: Tim Medin “Attacking Microsoft Kerberos: Kicking the Guard Dog of Hades”
211https://www.youtube.com/watch?v=PUyhlN-E5MU
212
213Exploiting Group Policy Preferences
214\\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\
215
216
217FINDING DOMAIN CONTROLLERS
218• Get-ADDomain
219import-module ActiveDirectory
220$ADInfo = Get-ADDomain
221$ADDomainReadOnlyReplicaDirectoryServers =
222$ADInfo.ReadOnlyReplicaDirectoryServers
223$ADDomainReplicaDirectoryServers = $ADInfo.ReplicaDirectoryServers
224$DomainControllers = $ADDomainReadOnlyReplicaDirectoryServers + `
225ADDomainReplicaDirectoryServers
226• Get-ADDomainController
227import-module ActiveDirectory
228$DomainControllers = Get-ADDomainController -filter * -DomainName $DOMAIN
229
230DOMAIN CONTROLLER INVENTORY
231Import-Module ActiveDirectory
232Get-ADDomainController –filter * | `
233select hostname,IPv4Address,IsGlobalCatalog,IsReadOnly,OperatingSystem | `
234format-table -auto 
235
236DOMAIN CONTROLLERS DISCOVERY
237• Discover PDCe in domain:
238Get-ADDomainController –Discover –ForceDiscover –Service “PrimaryDC” –
239DomainName “lab.adsecurity.org”
240• Discover DCs in a Site:
241Get-ADDomainController –Discover –Site “HQ”
242• Find all Read-Only Domain Controllers that are GCs
243Get-ADDomainController –filter `
244{ (isGlobalCatalog –eq $True) –AND (isReadOnly –eq $True) }
245
246DISCOVERING GLOBAL CATALOGS (GCS)
247• Forest GCs
248import-module ActiveDirectory
249$ADForest = Get-ADForest
250$ADForestGlobalCatalogs = $ADForest.GlobalCatalogs
251• Domain DCs that are GCs
252import-module ActiveDirectory
253$DCsNotGCs = Get-ADDomainController -filter { IsGlobalCatalog -eq $True}
254• Domain DCs that are not GCs
255import-module ActiveDirectory
256$DCsNotGCs = Get-ADDomainController -filter { IsGlobalCatalog -eq $False }
257
258FINDING FSMOS
259• AD Cmdlets
260Import-Module ActiveDirectory
261(Get-ADForest).SchemaMaster
262(Get-ADForest).DomainNamingMaster
263(Get-ADDomain).InfrastructureMaster
264(Get-ADDomain).PDCEmulator
265(Get-ADDomain).RIDMaster
266• .Net
267([System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()).SchemaRoleOwner
268([System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()).NamingRoleOwner
269([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).InfrastructureRoleOwner
270([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).PdcRoleOwner
271([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).RidRoleOwner
272
273ENUMERATE DOMAIN DFS SHARES
274$DomainDNS = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().Name
275$ADDomainDistinguishedName = (Get-ADDomain).DistinguishedName
276$DFSConfigObjectDN = "CN=Dfs-Configuration,CN=System,$ADDomainDistinguishedName“
277$DFSConfigurationObject = Get-ADObject $DFSConfigObjectDN
278$DFSShareData = Get-ChildItem "AD:$DFSConfigObjectDN"
279ForEach ($DFSShareDataItem in $DFSShareData)
280{ ## OPEN ForEach ($DFSShareDataItem in $DFSShareData)
281$DFSShareDataItemDN = $DFSShareDataItem.DistinguishedName
282$DFSShareDataItemNameArray = $DFSShareDataItemDN -split '=‘
283$DFSShareDataItemNameArray2 = $DFSShareDataItemNameArray -split ',‘
284$DFSShareDataItemName = $DFSShareDataItemNameArray2[1]
285$DFSShareDataItemServerPath = Get-ADObject $DFSShareDataItemDN -property *,RemoteServerName
286Write-Output "DFS Share Name: $DFSShareDataItemName `r “
287Write-Output "$DFSShareDataItemDN `r “
288$DFSShareDataItemServerPathName = ($DFSShareDataItemServerPath.RemoteServerName) -replace ('\*',"")
289$DFSShareDataItemServerPathName
290write-output " `r “
291} ## CLOSE ForEach ($DFSShareDataItem in $DFSShareData)
292
293Default Logon Rights to Domain Controllers
294Enterprise Admins (admin on all DCs in the forest),
295Domain Admins
296Administrators
297Backup Operators
298Server Admins
299Account Operators (can logon to DCs)
300Print Operators
301
302Dumping AD Domain Credentials
303Dump credentials on DC (local or remote).
304 • Run Mimikatz (WCE, etc) on DC.
305 • Invoke-Mimikatz on DC via PS Remoting.
306Get access to the NTDS.dit file & extract data.
307 • Copy AD database from remote DC.
308 • Grab AD database copy from backup.
309 • Get Virtual DC data
310
311DC Discovery (DNS)
312PS C:\windows\system32> nslookup -querytype=SRV _LDAP._TCP.DC._MSDCS.testlab.local
313or
314PS C:\windows\system32> [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().DomainControllers
315
316Discovering Data
317•Invoke-UserHunter:
318• User home directory servers & shares
319• User profile path servers & shares
320• Logon script paths
321• Performs Get-NetSession against each.
322•Discovering DFS shares
323
324DNS via LDAP
325PS> get-adcomputer -filter * -Properties ipv4address | where {$_.IPv4address} | select name,ipv4address
326PS> get-adcomputer -filter -filter {IPv4address -eq ‘172.16.11.13’} -Properties Lastlogondate,passwordlastset,ipv4address
327
328PS> get-adgroup “Domain Admins” | Get-ADGroupMember
329PS> Get-NetUser -AdminCount | select name,whencreated,pwdlastset,lastlogon
330PS> get-aduser -filter {AdminCount -eq 1} -prop * | select name,created,PasswordLastSet,LastLogonDate
331
332Discover AD Groups with local admin rights
333PS> Get-NetGPOGroup
334PS> Find-GPOComputerAdmin -OUName ‘OU=Workstations,DC=testlab,DC=local’
335PS> get-NetComputer -ADSpath ‘OU=workstations,DC=testlab,DC=local’
336
337Computers with admin rights
338PS> get-netgroup “*admins*” | Get-NetGroupMember -Recurse | ?{$_.MemberName -Like ‘*$}
339
340Discover Users with Admin rights
341PS> get-netgroup “*admins*” | get-netgroupmember -recurse | ${Get-NetUser $_.MemberName -filter ‘(mail=*)’}
342PS> get-netgroup “*admins*” | Get-Netgroupmember -recurse | ?{$_.MemberName -Like ‘*.*’}
343
344Discover virtual Admins
345PS> get-netgroup “*Hyper*” | Get-NetGroupMember
346PS> get-netgroup “*VMWare*” | Get-NetGroupMember
347
348
349PowerView AD Recon Cheat Sheet
350• Get-NetForest
351• Get-NetDomain
352• Get-NetForestTrust
353• Get-NetDomainTrust
354• Invoke-MapDomainTrust
355• Get-NetDomainController
356• Get-DomainPolicy
357• Get-NetGroup
358• Get-NetGroupMember
359• Get-NetGPO
360• Get-NetGPOGroup
361• Get-NetUser
362• Invoke-ACLScanner
363
364
365
366Scanning for Active Directory Privileges & Privileged Accounts
367By Sean Metcalf, adsecurity.orgAfficher l'originaljuin 14, 2017ad
368Active Directory Recon is the new hotness since attackers, Red Teamers, and penetration testers have realized that control of Active Directory provides power over the organization.
369
370I covered ways to enumerate permissions in AD using PowerView (written by Will @harmj0y) during my Black Hat & DEF CON talks in 2016 from both a Blue Team and Red Team perspective.
371
372This post details how privileged access is delegated in Active Directory and how best to discover who has what rights and permissions in AD. When we perform an Active Directory Security Assessment for customers, we review all of the data points listed in this post, including the privileged groups and the rights associated with them by fully interrogating Active Directory and mapping the associated permissions to rights and associating these rights to the appropriate groups (or accounts).
373
374I have had this post in draft for a while and with Bloodhound now supporting AD ACLs (nice work Will @harmj0y & Andy @_Wald0!), it’s time to get more information out about AD permissions. Examples in this post use the PowerView PowerShell cmdlets.
375
376Active Directory Privileged Access
377
378The challenge is often determining what access each group actually has. Often the full impact of what access a group actually has is not fully understood by the organization. Attackers leverage access (though not always privileged access) to compromise Active Directory.
379
380The key point often missed is that rights to Active Directory and key resources is more than just group membership, it is the combined rights the user has which is made up of:
381
382Active Directory group membership.
383AD groups with privileged rights on computers
384Delegated rights to AD objects by modifying the default permissions (for security principals, both direct and indirect).
385Rights assigned to SIDs in SIDHistory to AD objects.
386Delegated rights to Group Policy Objects.
387User Rights Assignments configured on workstations, servers, and Domain Controllers via Group Policy (or Local Policy) defines elevated rights and permissions on these systems.
388Local group membership on a computer or computers (similar to GPO assigned settings).
389Delegated rights to shared folders.
390Group Membership
391
392Enumerating group membership is the easy way to discovering  privileged accounts in Active Directory, though it often doesn’t tell the full story.  Membership in Domain Admins, Administrators, and Enterprise Admins obviously provides full domain/forest admin rights. Custom groups are created and delegated access to resources.
393
394This screenshot shows using PowerView to find VMWare groups and list the members.
395
396
397Interesting Groups with default elevated rights:
398
399Account Operators: Active Directory group with default privileged rights on domain users and groups, plus the ability to logon to Domain Controllers 
400Well-Known SID/RID: S-1-5-32-548 
401The Account Operators group grants limited account creation privileges to a user. Members of this group can create and modify most types of accounts, including those of users, local groups, and global groups, and members can log in locally to domain controllers. 
402Members of the Account Operators group cannot manage the Administrator user account, the user accounts of administrators, or the Administrators, Server Operators, Account Operators, Backup Operators, or Print Operators groups. Members of this group cannot modify user rights. 
403The Account Operators group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
404
405By default, this built-in group has no members, and it can create and manage users and groups in the domain, including its own membership and that of the Server Operators group. This group is considered a service administrator group because it can modify Server Operators, which in turn can modify domain controller settings. As a best practice, leave the membership of this group empty, and do not use it for any delegated administration. This group cannot be renamed, deleted, or moved.
406
407Administrators: Local or Active Directory group. The AD group has full admin rights to the Active Directory domain and Domain Controllers 
408Well-Known SID/RID: S-1-5-32-544 
409Members of the Administrators group have complete and unrestricted access to the computer, or if the computer is promoted to a domain controller, members have unrestricted access to the domain. 
410The Administrators group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
411
412The Administrators group has built-in capabilities that give its members full control over the system. This group cannot be renamed, deleted, or moved. This built-in group controls access to all the domain controllers in its domain, and it can change the membership of all administrative groups. 
413Membership can be modified by members of the following groups: the default service Administrators, Domain Admins in the domain, or Enterprise Admins. This group has the special privilege to take ownership of any object in the directory or any resource on a domain controller. This account is considered a service administrator group because its members have full access to the domain controllers in the domain.
414
415This security group includes the following changes since Windows Server 2008: 
416Default user rights changes: Allow log on through Terminal Services existed in Windows Server 2008, and it was replaced by Allow log on through Remote Desktop Services. 
417Remove computer from docking station was removed in Windows Server 2012 R2.
418
419Allowed RODC Password Replication Group: Active Directory group where members can have their domain password cached on a RODC after successfully authenticating (includes user and computer accounts). 
420Well-Known SID/RID: S-1-5-21-<domain>-571 
421The purpose of this security group is to manage a RODC password replication policy. This group has no members by default, and it results in the condition that new Read-only domain controllers do not cache user credentials. The Denied RODC Password Replication Group group contains a variety of high-privilege accounts and security groups. The Denied RODC Password Replication group supersedes the Allowed RODC Password Replication group. 
422The Allowed RODC Password Replication group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
423This security group has not changed since Windows Server 2008.
424
425Backup Operators: Local or Active Directory group. AD group members can backup or restore Active Directory and have logon rights to Domain Controllers (default). 
426Well-Known SID/RID: S-1-5-32-551 
427Members of the Backup Operators group can back up and restore all files on a computer, regardless of the permissions that protect those files. Backup Operators also can log on to and shut down the computer. This group cannot be renamed, deleted, or moved. By default, this built-in group has no members, and it can perform backup and restore operations on domain controllers. Its membership can be modified by the following groups: default service Administrators, Domain Admins in the domain, or Enterprise Admins. It cannot modify the membership of any administrative groups. While members of this group cannot change server settings or modify the configuration of the directory, they do have the permissions needed to replace files (including operating system files) on domain controllers. Because of this, members of this group are considered service administrators. 
428The Backup Operators group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
429This security group has not changed since Windows Server 2008.
430
431Certificate Service DCOM Access: Active Directory group. 
432Well-Known SID/RID: S-1-5-32-<domain>-574 
433Members of this group are allowed to connect to certification authorities in the enterprise. 
434The Certificate Service DCOM Access group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
435This security group has not changed since Windows Server 2008.
436
437Cert Publishers: Active Directory group. 
438Well-Known SID/RID: S-1-5-<domain>-517 
439Members of the Cert Publishers group are authorized to publish certificates for User objects in Active Directory. 
440The Cert Publishers group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
441This security group has not changed since Windows Server 2008.
442
443Distributed COM Users 
444Well-Known SID/RID: S-1-5-32-562 
445Members of the Distributed COM Users group are allowed to launch, activate, and use Distributed COM objects on the computer. Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. Distributed Component Object Model (DCOM) allows applications to be distributed across locations that make the most sense to you and to the application. This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). 
446The Distributed COM Users group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
447This security group has not changed since Windows Server 2008.
448
449DnsAdmins: Local or Active Directory group. Members of this group have admin rights to AD DNS and can run code via DLL on a Domain Controller operating as a DNS server. 
450Well-Known SID/RID: S-1-5-21-<domain>-1102 
451Members of DNSAdmins group have access to network DNS information. The default permissions are as follows: Allow: Read, Write, Create All Child objects, Delete Child objects, Special Permissions. 
452For information about other means to secure the DNS server service, see Securing the DNS Server Service. 
453This security group has not changed since Windows Server 2008.
454
455Domain Admins: Active Directory group with full admin rights to the Active Directory domain and all computers (default), including all workstations, servers, and Domain Controllers. Gains this right through automatic membership in the Administrators group for the domain as well as all computers when they are joined to the domain. 
456Well-Known SID/RID: S-1-5-<domain>-512 
457Members of the Domain Admins security group are authorized to administer the domain. By default, the Domain Admins group is a member of the Administrators group on all computers that have joined a domain, including the domain controllers. The Domain Admins group is the default owner of any object that is created in Active Directory for the domain by any member of the group. If members of the group create other objects, such as files, the default owner is the Administrators group. 
458The Domain Admins group controls access to all domain controllers in a domain, and it can modify the membership of all administrative accounts in the domain. Membership can be modified by members of the service administrator groups in its domain (Administrators and Domain Admins), and by members of the Enterprise Admins group. This is considered a service administrator account because its members have full access to the domain controllers in a domain. 
459The Domain Admins group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
460This security group has not changed since Windows Server 2008.
461
462Enterprise Admins: Active Directory group with full admin rights to all Active Directory domains in the AD forest and gains this right through automatic membership in the Administrators group in every domain in the forest. 
463Well-Known SID/RID: S-1-5-21-<root domain>-519 
464The Enterprise Admins group exists only in the root domain of an Active Directory forest of domains. It is a Universal group if the domain is in native mode; it is a Global group if the domain is in mixed mode. Members of this group are authorized to make forest-wide changes in Active Directory, such as adding child domains. 
465By default, the only member of the group is the Administrator account for the forest root domain. This group is automatically added to the Administrators group in every domain in the forest, and it provides complete access for configuring all domain controllers. Members in this group can modify the membership of all administrative groups. Membership can be modified only by the default service administrator groups in the root domain. This is considered a service administrator account. 
466The Enterprise Admins group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
467This security group has not changed since Windows Server 2008.
468
469Event Log Readers 
470Well-Known SID/RID: S-1-5-32-573 
471Members of this group can read event logs from local computers. The group is created when the server is promoted to a domain controller. 
472The Event Log Readers group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
473This security group has not changed since Windows Server 2008.
474
475Group Policy Creators Owners: Active Directory group with the ability to create Group Policies in the domain. 
476Well-Known SID/RID: S-1-5-<domain>-520 
477This group is authorized to create, edit, or delete Group Policy Objects in the domain. By default, the only member of the group is Administrator. 
478The Group Policy Creators Owners group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
479This security group has not changed since Windows Server 2008.
480
481Hyper-V Administrators 
482Well-Known SID/RID: S-1-5-32-578 
483Members of the Hyper-V Administrators group have complete and unrestricted access to all the features in Hyper-V. Adding members to this group helps reduce the number of members required in the Administrators group, and further separates access. 
484System_CAPS_noteNote 
485Prior to Windows Server 2012, access to features in Hyper-V was controlled in part by membership in the Administrators group. 
486This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
487
488Pre–Windows 2000 Compatible Access 
489Well-Known SID/RID: S-1-5-32-554 
490Members of the Pre–Windows 2000 Compatible Access group have Read access for all users and groups in the domain. This group is provided for backward compatibility for computers running Windows NT 4.0 and earlier. By default, the special identity group, Everyone, is a member of this group. Add users to this group only if they are running Windows NT 4.0 or earlier. 
491System_CAPS_warningWarning 
492This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). 
493The Pre–Windows 2000 Compatible Access group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
494This security group has not changed since Windows Server 2008.
495
496Print Operators 
497Well-Known SID/RID: S-1-5-32-550 
498Members of this group can manage, create, share, and delete printers that are connected to domain controllers in the domain. They can also manage Active Directory printer objects in the domain. Members of this group can locally sign in to and shut down domain controllers in the domain. 
499This group has no default members. Because members of this group can load and unload device drivers on all domain controllers in the domain, add users with caution. This group cannot be renamed, deleted, or moved. 
500The Print Operators group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
501This security group has not changed since Windows Server 2008. However, in Windows Server 2008 R2, functionality was added to manage print administration. For more information, see Assigning Delegated Print Administrator and Printer Permission Settings in Windows Server 2008 R2.
502
503Protected Users 
504Well-known SID/RID: S-1-5-21-<domain>-525 
505Members of the Protected Users group are afforded additional protection against the compromise of credentials during authentication processes. 
506This security group is designed as part of a strategy to effectively protect and manage credentials within the enterprise. Members of this group automatically have non-configurable protection applied to their accounts. Membership in the Protected Users group is meant to be restrictive and proactively secure by default. The only method to modify the protection for an account is to remove the account from the security group. 
507This domain-related, global group triggers non-configurable protection on devices and host computers running Windows Server 2012 R2 and Windows 8.1, and on domain controllers in domains with a primary domain controller running Windows Server 2012 R2. This greatly reduces the memory footprint of credentials when users sign in to computers on the network from a non-compromised computer.
508
509Depending on the account’s domain functional level, members of the Protected Users group are further protected due to behavior changes in the authentication methods that are supported in Windows. 
510Members of the Protected Users group cannot authenticate by using the following Security Support Providers (SSPs): NTLM, Digest Authentication, or CredSSP. Passwords are not cached on a device running Windows 8.1, so the device fails to authenticate to a domain when the account is a member of the Protected User group.
511
512The Kerberos protocol will not use the weaker DES or RC4 encryption types in the preauthentication process. This means that the domain must be configured to support at least the AES cipher suite.
513
514The user’s account cannot be delegated with Kerberos constrained or unconstrained delegation. This means that former connections to other systems may fail if the user is a member of the Protected Users group. 
515The default Kerberos ticket-granting tickets (TGTs) lifetime setting of four hours is configurable by using Authentication Policies and Silos, which can be accessed through the Active Directory Administrative Center. This means that when four hours has passed, the user must authenticate again.
516
517The Protected Users group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
518This group was introduced in Windows Server 2012 R2. For more information about how this group works, see Protected Users Security Group. 
519The following table specifies the properties of the Protected Users group.
520
521Remote Desktop Users 
522Well-Known SID/RID: S-1-5-32-555 
523The Remote Desktop Users group on an RD Session Host server is used to grant users and groups permissions to remotely connect to an RD Session Host server. This group cannot be renamed, deleted, or moved. It appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). 
524The Remote Desktop Users group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
525This security group has not changed since Windows Server 2008.
526
527Schema Admins 
528Well-Known SID/RID: S-1-5-<root domain>-518 
529Members of the Schema Admins group can modify the Active Directory schema. This group exists only in the root domain of an Active Directory forest of domains. It is a Universal group if the domain is in native mode; it is a Global group if the domain is in mixed mode. 
530The group is authorized to make schema changes in Active Directory. By default, the only member of the group is the Administrator account for the forest root domain. This group has full administrative access to the schema. 
531The membership of this group can be modified by any of the service administrator groups in the root domain. This is considered a service administrator account because its members can modify the schema, which governs the structure and content of the entire directory. 
532For more information, see What Is the Active Directory Schema?: Active Directory. 
533The Schema Admins group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
534This security group has not changed since Windows Server 2008.
535
536Server Operators 
537Well-Known SID/RID: S-1-5-32-549 
538Members in the Server Operators group can administer domain servers. This group exists only on domain controllers. By default, the group has no members. Memebers of the Server Operators group can sign in to a server interactively, create and delete network shared resources, start and stop services, back up and restore files, format the hard disk drive of the computer, and shut down the computer. This group cannot be renamed, deleted, or moved. 
539By default, this built-in group has no members, and it has access to server configuration options on domain controllers. Its membership is controlled by the service administrator groups, Administrators and Domain Admins, in the domain, and the Enterprise Admins group. Members in this group cannot change any administrative group memberships. This is considered a service administrator account because its members have physical access to domain controllers, they can perform maintenance tasks (such as backup and restore), and they have the ability to change binaries that are installed on the domain controllers. Note the default user rights in the following table. 
540The Server Operators group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
541This security group has not changed since Windows Server 2008.
542
543WinRMRemoteWMIUsers_ 
544Well-Known SID/RID: S-1-5-21-<domain>-1000 
545In Windows 8 and in Windows Server 2012, a Share tab was added to the Advanced Security Settings user interface. This tab displays the security properties of a remote file share. To view this information, you must have the following permissions and memberships, as appropriate for the version of Windows Server that the file server is running.
546
547The WinRMRemoteWMIUsers_ group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version. 
548If the file share is hosted on a server that is running a supported version of the operating system:
549
550You must be a member of the WinRMRemoteWMIUsers__ group or the BUILTIN\Administrators group.
551You must have Read permissions to the file share.
552If the file share is hosted on a server that is running a version of Windows Server that is earlier than Windows Server 2012:
553
554You must be a member of the BUILTIN\Administrators group.
555You must have Read permissions to the file share.
556In Windows Server 2012, the Access Denied Assistance functionality adds the Authenticated Users group to the local WinRMRemoteWMIUsers__ group. Therefore, when the Access Denied Assistance functionality is enabled, all authenticated users who have Read permissions to the file share can view the file share permissions.
557
558The WinRMRemoteWMIUsers_ group allows running Windows PowerShell commands remotely whereas the Remote Management Users group is generally used to allow users to manage servers by using the Server Manager console. 
559This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
560
561Active Directory Groups with Privileged Rights on Computers
562
563Most organizations use Group Policy to add an Active Directory group to a local group on computers (typically the Administrators group). Using PowerView, we can easily discover the AD groups that have admin rights on workstations and servers (which is the typical use case).
564
565In the following screenshot, we see that the organization has configured the following GPOs:
566
567GPO: “Add Server Admins to Local Administrator Group” 
568Local Group: Administrators 
569AD Group: Server Admins (SID is shown in the example)
570
571GPO: “Add Workstation Admins to Local Administrator Group” 
572Local Group: Administrators 
573AD Group: Workstation Admins (SID is shown in the example)
574
575
576We can also use PowerView to identify what AD groups have admin rights on computers by OU.
577
578
579Active Directory Object Permissions (ACLs)
580
581Similar to file system permissions, Active Directory objects have permissions as well.
582
583These permissions are called Access Control Lists (ACLs). The permissions set on objects use a cryptic format called Security Descriptor Definition Language (SDDL) which looks like this: 
584D:PAI(D;OICI;FA;;;BG)(A;OICI;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;FA;;;BU)
585
586This is translated by the GUI to provide the more user-friendly format we are used to (see screenshot below).
587
588Every Active Directory object has permissions configured on them, either explicitly defined, or inherited from an object above them (typically an OU or the domain) and the permission can be defined to either allow or deny permissions on the object and its properties.
589
590When performing Active Directory security assessments, we scan Active Directory for AD ACLs and identify the accounts/groups with privileged rights based on the delegation on AD objects such as the domain, OUs, security groups, etc.
591
592Every object in Active Directory has default permissions applied to it as well as inherited and any explicit permissions. Given that by default Authenticated Users have read access to objects in AD, most of their properties and the permissions defined on the objects, AD objects, their properties and permissions are easily gathered.
593
594One quick note about AD ACLs. There is an object in the System container called “AdminSDHolder ” which only has one purpose: to be the permissions template object for objects (and their members) with high levels of permissions in the domain.
595
596SDProp Protected Objects (Windows Server 2008 & Windows Server 2008 R2):
597Account Operators
598Administrator
599Administrators
600Backup Operators
601Domain Admins
602Domain Controllers
603Enterprise Admins
604Krbtgt
605Print Operators
606Read-only Domain Controllers
607Replicator
608Schema Admins
609Server Operators
610About every 60 minutes, the PDC emulator runs a process to enumerate all of these protected objects and their members and then stamps the permissions configured on the AdminSDHolder object (and sets the admin attribute to ‘1’). This ensures that privileged groups and accounts are protected from improper AD permission delegation.
611
612It’s extremely difficult to stay on top of custom permissions on AD objects. For example, the following graphic shows permissions on an OU.
613
614
615There’s a serious issue with the delegation on this OU which is highlighted below. 
616This issue is delegation to Domain Controllers with Full Control rights on all objects to this OU and all objects contained in it.
617
618
619An attacker is most interested in permissions that provide privileged actions. These ACLs include:
620
621Replicating Directory Changes All: An Extended Right that provides the ability to replicate all data for an object, including password data (I call this the Domain Controller impersonation right) which provides the ability to “DCSync” the password data for AD users and computers.Example: FIM, Riverbed, SharePoint, and other applications often have a service account granted this right on the domain root. If an attacker can guess this password (or potentially crack it by Kerberoasting), they now own the domain since they can DCSync password hashes for all AD users and computers (including Domain Admins and Domain Controllers).
622GenericAll: GenericAll = Full Control 
623The right to create or delete children, delete a subtree, read and write properties, examine children and the object itself, add and remove the object from the directory, and read or write with an extended right. 
624It provides full rights to the object and all properties, including confidential attributes  such as LAPS local Administrator passwords, and BitLocker recovery keys. In many cases, Full Control rights aren’t required, but it’s easier to delegate and get working than determining the actual rights required. 
625Example: A Server tier group may be delegated Full Control on all Computer objects in an OU that has the computer objects associated with servers. Another common configuration is delegating Full Control on all Computer objects in the Workstations OU for the Desktop Support group, and delegating Full Control on all user objects in the Users OU for the Help Desk.
626GenericWrite: Provides write access to all properties. 
627The right to read permissions on this object, write all the properties on this object, and perform all validated writes to this object.
628WriteDACL: Provides the ability to modify security on an object which can lead to Full Control of the object. 
629The right to modify the DACL in the object security descriptor. 
630Example: A service account may be granted this right to perform delegation in AD. If an attacker can guess this password (or potentially crack it by Kerberoasting), they now set their own permissions on associated objects which can lead to Full Control of an object which may involve exposure of a LAPS controlled local Administrator password.
631Self:  Provides the ability to perform validated writes. 
632The right to perform an operation that is controlled by a validated write access right. 
633Validated writes include the following attributes:
634Self-Membership(bf9679c0-0de6-11d0-a285-00aa003049e2 / member attribute)
635Validated-DNS-Host-Name 
636(72e39547-7b18-11d1-adef-00c04fd8d5cd / dNSHostName attribute)
637Validated-MS-DS-Additional-DNS-Host-Name 
638(80863791-dbe9-4eb8-837e-7f0ab55d9ac7 / msDS-AdditionalDnsHostName attribute)
639Validated-MS-DS-Behavior-Version 
640(d31a8757-2447-4545-8081-3bb610cacbf2 / msDS-Behavior-Version attribute)
641Validated-SPN 
642(f3a64788-5306-11d1-a9c5-0000f80367c1 / servicePrincipalName attribute)
643WriteOwner:: Provides the ability to take ownership of an object. The owner of an object can gain full control rights on the object. 
644The right to assume ownership of the object. The user must be an object trustee. The user cannot transfer the ownership to other users.
645WriteProperty: Typically paired with specific attribute/property information.Example: The help desk group is delegated the ability to modify specific AD object properties like Member (to modify group membership), Display Name, Description, Phone Number, etc.
646CreateChild: Provides the ability to create an object of a specified type (or “All”).
647DeleteChild: Provides the ability to delete an object of a specified type (or “All”).
648Extended Right: This is an interesting one because if provides additional rights beyond the obvious.Example: All Extended Right permissions to a computer object may provide read access to the LAPS Local Administrator password attribute.
649Andy Robbin’s (@_Wald0) post covers ways these rights can be abused.
650
651The ability to create and link GPOs in a domain should be seen as effective Domain Admin rights since it provides the ability to modify security settings, install software, configure user and computer logon (and startup/shutdown) scripts, and run commands.
652
653Manage Group Policy link (LinkGPO): Provides the ability to link an existing Group Policy Object in Active Directory to the domain, OU, and/or site where the right is defined. By default, GPO Creator Owners has this right. 
654Create GPOs: By default, the AD group Group Policy Creator Owners has this right. Can be delegated via the Group Policy Management Console (GPMC).
655PowerView provides the ability to to search AD permissions for interesting rights.
656
657
658
659SIDHistory
660
661SID History is an attribute that supports migration scenarios. Every user account has an associated Security IDentifier (SID) which is used to track the security principal and the access the account has when connecting to resources. SID History enables access for another account to effectively be cloned to another. This is extremely useful to ensure users retain access when moved (migrated) from one domain to another. Since the user’s SID changes when the new account is created, the old SID needs to map to the new one. When a user in Domain A is migrated to Domain B, a new user account is created in DomainB and DomainA user’s SID is added to DomainB’s user account’s SID History attribute. This ensures that DomainB user can still access resources in DomainA.
662
663This means that if an account has privileged accounts or groups in its SIDHistory attribute, the account receives all the rights assigned to those accounts or groups, be they assigned directly or indirectly. If an attacker gains control of this account, they have all of the associated rights. The rights provided via SIDs in SIDHistory are likely not obvious and therefore missed.
664
665Group Policy Permissions
666
667Group Policy Objects (GPOs) are created, configured, and linked in Active Directory. When a GPO is linked to an OU, the settings in the GPO are applied to the appropriate objects (users/computers) in that OU.
668
669Permissions on GPOs can be configured to delegate GPO modify rights to any security principal.
670
671If there are custom permissions configured on Group Policies linked to the domain and an attacker gains access to an account with modify access, the domain can be compromised. An attacker modifies GPO settings to run code or install malware. The impact of this level of access depends on where the GPO is linked. If the GPO is linked to the domain or Domain Controllers container, they own the domain. IF the GPO is linked to a workstations or servers OU, the impact may be less somewhat; however, the ability to run code on all workstations or servers, it may be possible to still compromise the domain.
672
673Scanning for GPO permissions identifies which GPOs are improperly permissioned and scanning for where the GPO is linked determines the impact.
674
675Fun fact: The creator of a Group Policy retains modify rights to the GPO. A possible result is that a Domain Admin needs to set an audit policy for the domain, but discovers that an OU admin has already created a GPO with the required settings. So, the Domain Admin links this GPO to the domain root which applies the settings to all computers in the domain. The problem is the OU admin can still modify a GPO that is now linked to the domain root providing an escalation path if this OU admin account is compromised. The following graphic shows the OU Admin “Han Solo” with GPO edit rights.
676
677
678PowerView provides a quick way to scan all the permissions for all domain GPOs:
679
680Get-NetGPO | %{Get-ObjectAcl -ResolveGUIDs -Name $_.Name}
681Reference: Abusing GPO Permissions
682
683User Rights Assignment
684
685User Rights Assignments are frequently configured in a computer GPO and defines several rights to the computer.
686
687Domain Controllers are often configured with User Rights Assignments in the Default Domain Controllers Policy applied to the Domain Controllers container. Parsing the GPOs linked to Domain Controllers provides useful information about security principals with elevated rights to DCs and the domain.
688
689These assignments include:
690
691SeTrustedCredManAccessPrivilege: Access Credential Manager as a trusted caller
692SeNetworkLogonRight:  Access this computer from the network
693SeTcbPrivilege:  Act as part of the operating system
694SeMachineAccountPrivilege:  Add workstations to domain
695SeIncreaseQuotaPrivilege:  Adjust memory quotas for a process
696SeInteractiveLogonRight:  Allow log on locally
697SeRemoteInteractiveLogonRight:  Allow log on through Remote Desktop Services
698SeBackupPrivilege:  Back up files and directories
699SeChangeNotifyPrivilege:  Bypass traverse checking
700SeSystemtimePrivilege:  Change the system time
701SeTimeZonePrivilege:  Change the time zone
702SeCreatePagefilePrivilege:  Create a pagefile
703SeCreateTokenPrivilege:  Create a token object
704SeCreateGlobalPrivilege:  Create global objects
705SeCreatePermanentPrivilege:  Create permanent shared objects
706SeCreateSymbolicLinkPrivilege:  Create symbolic links
707SeDebugPrivilege:  Debug programs
708SeDenyNetworkLogonRight:  Deny access to this computer from the network
709SeDenyBatchLogonRight:  Deny log on as a batch job
710SeDenyServiceLogonRight:  Deny log on as a service
711SeDenyInteractiveLogonRight:  Deny log on locally
712SeDenyRemoteInteractiveLogonRight:  Deny log on through Remote Desktop Services
713SeEnableDelegationPrivilege:  Enable computer and user accounts to be trusted for delegation
714SeRemoteShutdownPrivilege:  Force shutdown from a remote system
715SeAuditPrivilege:  Generate security audits
716SeImpersonatePrivilege:  Impersonate a client after authentication
717SeIncreaseWorkingSetPrivilege:  Increase a process working set
718SeIncreaseBasePriorityPrivilege:  Increase scheduling priority
719SeLoadDriverPrivilege:  Load and unload device drivers
720SeLockMemoryPrivilege:  Lock pages in memory
721SeBatchLogonRight:  Log on as a batch job
722SeServiceLogonRight:  Log on as a service
723SeSecurityPrivilege:  Manage auditing and security log
724SeRelabelPrivilege:  Modify an object label
725SeSystemEnvironmentPrivilege:  Modify firmware environment values
726SeManageVolumePrivilege:  Perform volume maintenance tasks
727SeProfileSingleProcessPrivilege:  Profile single process
728SeSystemProfilePrivilege:  Profile system performance
729SeUndockPrivilege:  Remove computer from docking station
730SeAssignPrimaryTokenPrivilege:  Replace a process level token
731SeRestorePrivilege:  Restore files and directories
732SeShutdownPrivilege:  Shut down the system
733SeSyncAgentPrivilege:  Synchronize directory service data
734SeTakeOwnershipPrivilege:  Take ownership of files or other objects
735The interesting ones in this list (especially in GPOs that apply to Domain Controllers):
736
737Allow logon locally & Allow logon over Remote Desktop Services: Provides logon rights.
738Manage auditing and security log: Provides the ability to view all events in the event logs, including security events, and clear the event log. 
739Fun Fact: Exchange Servers require this right, which means that if an attacker gains System rights on an Exchange server, they can clear Domain Controller security logs.
740Synchronize directory service data: “This policy setting determines which users and groups have authority to synchronize all directory service data, regardless of the protection for objects and properties. This privilege is required to use LDAP directory synchronization (dirsync) services. Domain controllers have this user right inherently because the synchronization process runs in the context of the System account on domain controllers.” 
741This means that an acocunt with this user right on a Domain Controller may be able to run DCSync.
742Enable computer and user accounts to be trusted for delegation: Provides the ability to configure delegation on computers and users in the domain. 
743Fun Fact: This provides the ability to set Kerberos delegation on a computer or user account.
744Impersonate a client after authentication: This one looks like some fun could be had with it…
745Putting it all together
746
747In order to effectively identify all accounts with privileged access, it’s important to ensure that all avenues are explored to effectively identify the rights. This means that defenders need to check the permission on AD objects, starting with Organizational Units (OUs) and then branching out to security groups.
748
749Things to check:
750
751Enumerate group membership of default groups (including sub-groups). Identify what rights are required and remove the others.
752Scan Active Directory (specifically OUs & security groups) for custom delegation.
753Scan for accounts with SIDHistory (should only be required during an active migration from one domain to another).
754Review User Rights Assignments in GPOs that apply to Domain Controllers, Servers, and Workstations.
755Review GPOs that add AD groups to local groups and ensure these are still required and the level of rights are appropriate