How to review privileged groups in Active Directory, including nested members and adminCount

Which groups count as privileged

Domain Admins, Enterprise Admins, Schema Admins, and the built-in Administrators group have full control of the domain or forest. Account Operators, Backup Operators, Server Operators, Print Operators, and DnsAdmins can usually escalate to full control. Group Policy Creator Owners and Key Admins are also sensitive. These groups and their members are “protected” by the AdminSDHolder mechanism.

Nested membership counts. A helpdesk group inside a group inside Domain Admins gives every helpdesk member domain admin rights.

AdminSDHolder and adminCount

Every 60 minutes, the SDProp process on the PDC emulator copies the permissions from the AdminSDHolder object onto every member of a protected group and sets adminCount to 1. That prevents delegated OU permissions from weakening privileged accounts. When an account leaves the group, adminCount stays 1 and inheritance stays off unless someone cleans it up.

Accounts with adminCount 1 that are no longer in any protected group are a useful list: they were privileged once and may still have unusual permissions or old passwords.

Lab: recursive membership and leftovers

Nest a helpdesk group into Server Operators in the lab, then list recursive membership of each privileged group. Then find accounts with adminCount 1 and compare them with current recursive members to find leftovers.

For each member, record who owns the account, when its password was last set, and when it last logged on. Admin accounts with old passwords or no recent logons should be removed or reviewed first.

Snippet

$groups='Domain Admins','Enterprise Admins','Schema Admins','Administrators','Account Operators','Backup Operators','Server Operators','Print Operators','DnsAdmins'
$members = foreach ($g in $groups) { Get-ADGroupMember $g -Recursive -ErrorAction SilentlyContinue | % { [pscustomobject]@{Group=$g; Member=$_.SamAccountName} } }
$members | Sort Group | Format-Table
$current = $members.Member | Sort -Unique
Get-ADUser -Filter 'adminCount -eq 1' -Properties adminCount, PasswordLastSet, LastLogonDate | Where { $_.SamAccountName -notin $current } | Select SamAccountName, PasswordLastSet, LastLogonDate

Shrinking the list

Most organizations need very few permanent Domain Admins, often two or three named admin accounts plus a break-glass account. Delegate day-to-day tasks such as password resets and computer joins to specific OUs instead. Keep operator groups empty unless there is a documented need.

Use separate admin accounts for privileged work, never a person’s everyday account, and alert on any change to these groups.

Diagram

A privileged group review

List
Recursive members of every protected group.
Leftovers
adminCount 1 accounts no longer in those groups.
Annotate
Owner, password age, last logon.
Shrink
Remove, delegate, and alert on changes.

Check yourself

1. Why use -Recursive when listing Domain Admins?

2. What does adminCount = 1 on a user who is no longer in a protected group suggest?

3. Which group is privileged even though its name sounds modest?