Active Directory¶
On a Server 2022 domain controller, accounts and groups live in Active Directory instead of the local machine. Everything in the Accounts group still applies; the tools change.
Tools¶
| Task | Tool |
|---|---|
| Users, groups, OUs | Active Directory Users and Computers (dsa.msc) |
| Domain-wide policy | Group Policy Management (gpmc.msc) → Default Domain Policy |
| Command line | net user /domain, net group /domain, and the ActiveDirectory PowerShell module |
List domain accounts and admins¶
net user /domain
net group "Domain Admins" /domain
net group "Enterprise Admins" /domain
net group "Schema Admins" /domain
PowerShell:
Get-ADUser -Filter * | Select Name, Enabled, SamAccountName
Get-ADGroupMember "Domain Admins" | Select Name
Privileged groups¶
Membership in any of these is domain-wide control. Compare each to the README.
| Group | Grants |
|---|---|
| Domain Admins | Administrator on every machine in the domain |
| Enterprise Admins | Everything, across every domain in the forest. Usually empty. |
| Schema Admins | Can change the AD schema. Usually empty. |
| Administrators (on the DC) | Administrator on domain controllers |
| Account Operators | Create and modify most accounts |
| Server Operators | Log on to DCs, manage services |
| Backup Operators | Back up (read) anything on the DC, including the AD database |
Remove:
Remove-ADGroupMember "Domain Admins" -Members hacker -Confirm:$false
Disable, remove, create¶
Disable-ADAccount hacker
Remove-ADUser hacker -Confirm:$false
New-ADUser carol -AccountPassword (Read-Host -AsSecureString) -Enabled $true -ChangePasswordAtLogon $true
Set-ADUser bob -PasswordNeverExpires $false
Local accounts on domain machines¶
On a domain-joined workstation, standard users should have domain accounts, not local ones (STIG WN11-00-000085). A local user account on a domain machine is outside the domain's password policy, auditing, and disablement. net user on the workstation should show only the built-in accounts and any local admin the organization uses for emergencies.
Object permissions¶
Every AD object has an access control list. A normal user with Write or Full Control on an OU, a group, or the domain root can add themselves to Domain Admins. Check with dsacls:
dsacls "DC=corp,DC=local"
dsacls "CN=Domain Admins,CN=Users,DC=corp,DC=local"
dsacls "OU=Staff,DC=corp,DC=local"
Look for entries granting FULL CONTROL, WRITE, or "WRITE PROPERTY" to Everyone, Authenticated Users, Domain Users, or a specific non-admin account. Remove:
dsacls "OU=Staff,DC=corp,DC=local" /R "CORP\bob"
GUI: dsa.msc → View → Advanced Features → right-click the object → Properties → Security.
Domain policy¶
Password, lockout, and audit policy for domain accounts come from gpmc.msc → Default Domain Policy, not the DC's local secpol.msc. The values are the same as the Password Policy and Lockout Policy pages. After editing, gpupdate /force.
Verify¶
Get-ADGroupMember "Domain Admins" | Select Name
Get-ADUser -Filter {Enabled -eq $true} | Select SamAccountName
Compare both to the README.
Example¶
net group "Domain Admins" /domain lists Administrator, alice, svc_backup, guest2. README: alice is the only domain admin. Remove svc_backup and guest2 from the group, then investigate whether either account should exist at all. dsacls "DC=corp,DC=local" shows Authenticated Users with WRITE. Remove it.