From the Field: Privileged Groups

🔎 𝗙𝗿𝗼𝗺 𝘁𝗵𝗲 𝗙𝗶𝗲𝗹𝗱 — Real-World Findings from Security Assessments

💥 𝟳𝟲.𝟮% of infrastructures I’ve assessed 𝗸𝗲𝗲𝗽 𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝗱 𝗴𝗿𝗼𝘂𝗽𝘀 𝗽𝗼𝗽𝘂𝗹𝗮𝘁𝗲𝗱 𝟮𝟰/𝟳

And yes — we’re back in the 70% range, I skipped them by mistake.

𝗟𝗲𝘁’𝘀 𝘀𝘁𝗮𝗿𝘁 𝘄𝗶𝘁𝗵 𝘁𝗵𝗲 𝗯𝗮𝘀𝗶𝗰𝘀:

❌ You don’t need to be in Enterprise Admins or Schema Admins 24/7.

❌ You should not use default groups like Server Operators, Account Operators, etc. These sound harmless — but in reality, they often enable escalation paths attackers can exploit.

✅ Review your privileged groups regularly.

✅ Remove any accounts that don’t absolutely need to be there.

(⚠️ Don’t touch the default AD\Administrator — that’s your DR account.)

You can scan for these misconfigurations using 𝗔𝗗𝗣𝗿𝗼𝗯𝗲 — my free and transparent AD assessment tool.

𝗔𝗻𝗱 𝗶𝗳 𝘆𝗼𝘂 𝗻𝗲𝗲𝗱 𝗼𝗻-𝗱𝗲𝗺𝗮𝗻𝗱 𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝘀, 𝗰𝗼𝗻𝘀𝗶𝗱𝗲𝗿 𝗶𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗶𝗻𝗴 𝗝𝘂𝘀𝘁-𝗜𝗻-𝗧𝗶𝗺𝗲 (𝗝𝗜𝗧) 𝗮𝗰𝗰𝗲𝘀𝘀:

🔹 Microsoft PAM for on-prem AD

🔹 Microsoft Entra PIM (for cloud & hybrid environments)

🔹 Or follow Microsoft’s manual PIM model (this is quite old)

(I will provide resources for these in the comments)

Usually 3rd party tools are used, these are just examples from Microsoft – but you can do quite a lot with them.

Start small. Review your groups. Then grow into JIT if needed.

🔍 𝗗𝗼 𝘆𝗼𝘂 𝘂𝘀𝗲 𝗝𝗜𝗧, 𝗣𝗜𝗠, 𝗼𝗿 𝗣𝗔𝗠 𝗶𝗻 𝘆𝗼𝘂𝗿 𝗼𝗿𝗴?