AD-PRIV-010: Protected Users not used for administrators¶

info Privileged access MITRE ATT&CK T1558 Reads: LDAP

Protected Users is empty while Domain Admins has enabled user members, so admin credentials can still be cached, delegated and used with NTLM, DES or RC4.

Also known as: protected-users

Why it matters¶

Members of Protected Users get protections that the domain controller and every supported Windows client enforce without further configuration:

no NTLM authentication, so no pass-the-hash and no NTLM relay of the account;
no DES or RC4 in Kerberos pre-authentication, so no RC4 keys to crack or reuse;
no unconstrained or constrained delegation of the account;
TGTs that cannot be renewed beyond the initial four hours;
no cached plaintext credentials or NT hash in CredSSP, WDigest or NTLM on the hosts the account logs on to, and no cached logon verifier.

Without it, a domain admin who logs on to a compromised server leaves behind material an attacker can reuse for hours or crack offline.

How ad-doctor detects it¶

The check fires when the domain has at least one enabled user (not a computer, not a gMSA/sMSA/dMSA) that is a transitive member of Domain Admins, including through primaryGroupID, and Protected Users (<domain SID>-525) has no user or computer members at all. The objects are the Domain Admins members, for example Administrator, adm_bob.

Once Protected Users has any member, this check is silent; the per-account gap is covered by AD-PRIV-002, which reports privileged accounts that are neither in Protected Users nor marked sensitive.

Attributes and probes read

memberOf (transitive) of Domain Admins (RID 512)
memberOf (transitive) of Protected Users (RID 525)

Severity¶

Always info. It is a hardening recommendation: the group adds protections, and adding members needs testing first because it disables NTLM and RC4 for them.

False positives and limits¶

Environments that still need NTLM or RC4 for admins (old management tools, applications that authenticate by IP address) cannot add those accounts yet. Accept the finding in an accepted-risk file with an expiry date while the dependency is removed.

Fix¶

Check that the domain is ready. Protected Users needs a domain functional level of Windows Server 2012 R2 or later for the DC-side protections, and admin accounts must have AES keys, which means a password set after the domain reached Windows Server 2008 functional level:
```
(Get-ADDomain).DomainMode
Get-ADGroupMember 'Domain Admins' -Recursive |
    Get-ADUser -Properties PasswordLastSet | Select-Object SamAccountName, PasswordLastSet
```
Add one test admin account first and use it for a few days: logon to admin workstations, remote management, every admin tool the team uses.
```
Add-ADGroupMember 'Protected Users' -Members adm_bob -WhatIf
```
Add the remaining administrators. Do not add service accounts, computer accounts or the only break-glass account: a break-glass account must still work when Kerberos does not.
Watch for failures in the Microsoft-Windows-Authentication/ProtectedUser-Client and ProtectedUserFailures-DomainController logs, which name the blocked authentication.

Verify¶

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-PRIV-010

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-PRIV-010"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References¶

Microsoft and vendors

MITRE ATT&CK

T1558

Available since 0.1.0.