Labs / Active Directory, defender view
Who is in Domain Admins?
Compare an LDAP export of Domain Admins with the approved Tier 0 list. Find the unapproved member, when the group last changed, and why that account is easy to attack.
Briefing
Quarterly access review. Domain Admins should hold three named admin accounts and a vaulted break-glass Administrator. Everything else belongs in narrower groups.
domain-admins.ldf is an ldifde export of the group and its members. approved-tier0.txt is the signed-off list.
admin-ws · Active Directory, defender view
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.