Skip to content

AD-GPO-006: GPOs grant admin rights on tier-0 servers outside tier 0

high   Group Policy   MITRE ATT&CK T1078.002, T1021.002   Reads: SYSVOL (SMB), LDAP

Group Policy makes non-tier-0 principals local administrators of servers that control the domain (DCs, CA, Entra Connect or Exchange hosts).

Why it matters

Tier-0 servers, the domain controllers and the hosts that can take the domain over (the CA, an Entra Connect server with a sync account that can DCSync, Exchange servers with rights over the domain), must be administered only by tier-0 principals. If a GPO makes anyone outside tier 0 a local administrator of one of these servers, that principal can read its secrets (LAPS passwords, the DPAPI backup key, the sync account, the CA's private key) and escalate to full domain control. The same holds when a Restricted Groups entry reaches a writable DC and rewrites a tier-0 domain group, since DCs have no local groups of their own.

This is the tier-0 slice of local-admin-by-GPO: while AD-GPO-005 flags broad groups anywhere, this check flags any non-tier-0 principal specifically on the servers that matter most.

How ad-doctor detects it

ad-doctor builds the set of tier-0 hosts (domain controllers, CA hosts, Entra Connect servers, Exchange servers, and computers in a tier-0 group or holding DCSync) and, using the same GPO scope engine as AD-GPO-005, reports entries where a non-tier-0, non-broad-group principal is placed in an administrator-equivalent local group on one of those hosts, or in a tier-0 domain group through the DCs. Each object names the GPO, the principal, the group, and the tier-0 host with its role, for example LabLocalAdmins: LabServerAdmins -> Administrators on EXCH01$ (Exchange server).

Attributes and probes read
  • GptTmpl.inf [Group Membership] (Restricted Groups)
  • Machine\Preferences\Groups\Groups.xml (GPP Local Users and Groups)
  • gPLink and GPO scope attributes
  • roles of each computer (DC, CA, Entra Connect, Exchange, tier-0 member)

Severity

Always high: a local administrator of a tier-0 server controls the domain. This covers non-tier-0 members (broad groups are AD-GPO-005) granted an administrator-equivalent local group on a DC, CA host, Entra Connect server or Exchange server, or added to a tier-0 domain group through a writable DC.

False positives and limits

  • Over-reporting by design, as for AD-GPO-005: WMI filters are assumed to match, items with item-level targeting are assumed to apply, Deny ACEs are ignored, and sites may be over-assumed. Confirm on a sample host with gpresult.
  • A legitimate tier-0 operator granted admin this way should be made a tier-0 principal (so it is expected), not left as a recurring finding.

Fix

  1. Remove the entry from the GPO (Restricted Groups or GPP Local Users and Groups), or move the tier-0 servers into an OU that only tier-0 GPOs reach.

  2. Administer tier-0 servers only from tier-0: dedicated admin groups, privileged access workstations, and LAPS for the local administrator password.

  3. Audit who already has access to the named servers and rotate any secrets they could have read while the grant was in place.

Verify

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-GPO-006

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-GPO-006"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References

Microsoft and vendors

Tools

MITRE ATT&CK

New in the next release.