Account Operators (todo)
Last updated
Last updated
The membership of the "Account Operators" group is configured in the Dumping DPAPI page.
The Account Operators group is a built in group in AD. By default it has no members.
The group grants limited account creation privileges to a user. Members of this group can create and modify most types of accounts, including those of users, local groups, and global groups, and members can log in locally to domain controllers.
By default it has no direct path to Domain Admin, but these groups might be able to add members to other groups which have other ACL's etc. In this lab (as far as I know) you cant become DA with these privileges.
Login to the DC locally (Not through RDP but only locally).
Create users.
Add users to low privileged groups. This can be achieved through the cmdlet Add-DomainGroupMember from PowerView. Since we didn't create any groups in the domain we will use the "Domain Guests" group.
Never use any of the "Operator" groups. Create specialised groups and minimal permissions for the tasks the different IT departments/roles need. Use the least privilege principal.
Members of the Account Operators group cannot manage the Administrator user account, the user accounts of administrators, or the , , , , or groups. Members of this group cannot modify user rights.
