AD-PRIV-003: Schema Admins or Enterprise Admins not empty¶

low Privileged access MITRE ATT&CK T1078.002 Reads: LDAP

Schema Admins or Enterprise Admins have standing members, although both groups should stay empty except while a forest-level change is being made.

Why it matters¶

Enterprise Admins are administrators of every domain in the forest and of the configuration partition, which holds the PKI, sites and the forest-wide settings. Schema Admins can change the schema, which is replicated to every domain controller and cannot be undone. A compromised member of either group is a forest compromise, not only a domain compromise: the attacker can reach child domains that the domain admins of those domains believed were separate.

Both groups are needed only for rare, planned operations (adding a domain, extending the schema for a product). Membership that stays in place between those operations only adds exposure.

How ad-doctor detects it¶

ad-doctor resolves both groups by SID (<domain SID>-518 and -519) and collects their transitive user and computer members, plus accounts whose primaryGroupID is 518 or 519. Each member is reported as group: account, for example Enterprise Admins: Administrator and Schema Admins: Administrator.

Both groups exist only in the forest root domain. When ad-doctor scans a child domain the groups are not found there and the check stays silent; scan the forest root to cover them.

Attributes and probes read

memberOf (transitive) of Schema Admins (RID 518) and Enterprise Admins (RID 519)
primaryGroupID

Severity¶

Always low. The members are already tier 0 through other groups in most domains; the finding is about standing forest-wide rights that nobody needs day to day.

False positives and limits¶

The built-in Administrator of the forest root is a member of both groups by default, so a new forest is reported. Microsoft's guidance allows it to stay in Enterprise Admins only when it is secured as described in Appendix D (long random password, sensitive and cannot be delegated, logon restrictions). If you keep it, accept that single finding object in an accepted-risk file with an owner and an expiry date.
A change in progress: membership during a planned schema update or domain promotion is expected. Remove it when the change is done.

Fix¶

See who is in the groups.

Get-ADGroupMember 'Enterprise Admins' -Recursive | Select-Object SamAccountName, objectClass
Get-ADGroupMember 'Schema Admins' -Recursive | Select-Object SamAccountName, objectClass

Remove the standing members.

Remove-ADGroupMember 'Schema Admins' -Members Administrator -WhatIf
Remove-ADGroupMember 'Enterprise Admins' -Members adm_alice -WhatIf

Add members only for the change, with an expiry. With the Privileged Access Management optional feature (forest functional level Windows Server 2016 or later), a membership can carry a time to live and disappears on its own. Enabling the feature cannot be undone, so review it first:
```
Enable-ADOptionalFeature 'Privileged Access Management Feature' `
    -Scope ForestOrConfigurationSet -Target corp.example -WhatIf
Add-ADGroupMember 'Schema Admins' -Members adm_alice `
    -MemberTimeToLive (New-TimeSpan -Hours 2) -WhatIf
```
Alert on changes: both are universal groups, so an addition raises event 4756 on the domain controller that made it (with Audit Security Group Management enabled).

Verify¶

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-PRIV-003

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-PRIV-003"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References¶

Microsoft and vendors

MITRE ATT&CK

T1078.002

Available since 0.1.0.