AdminSDHolder

Folks,

Today is Day-0 of Microsoft's 30-day Active Directory Security School, which starts on May 22, 2017. Today, I'll answer the 2nd (here's the 1st) $100 B question I had asked them, which concerns AdminSDHolder, the root of organizational cyber security worldwide.

[The insight I have provided below is worth a proverbial $100 Billion, so in your own interest, you should read it in its entirety.]

AdminSDHolder

If you're Microsoft, or one of millions of Windows/Active Directory admins or cyber security pros worldwide, you know that at the heart, root & foundation of administrative/privileged access in Active Directory lies one Active Directory object - AdminSDHolder.

In the interest of brevity, I'll skip the details and provide a very brief background here. In essence, all default Active Directory accounts and groups that are considered to be administrative in nature by Active Directory are protected with a special protected locked-down access control list (ACL), which is the access control list of the AdminSDHolder object -

AdminSDHolder

It logically follows that anyone who can modify the permissions specified in the AdminSDHolder object's ACL can easily control and impact the security afforded to all default Active Directory administrative accounts and groups, such as Domain Admins, Enterprise Admins, Administrators, Backup Operators, etc., as well as the default Administrator account, and all such accounts.

In other words, anyone (e.g. a rogue or coerced insider, an intruder, APT etc. ) who could modify the permissions specified in the AdminSDHolder object's ACL could instantly obtain complete administrative control over the entire Active Directory forest!




A $ Billion Question -

So a $ Billion question begs itself, and all organizations operating on Active Directory must ideally have an exact answer today -

Q: "In our Active Directory domain(s), exactly who can modify the permissions specified in the AdminSDHolder object's ACL?"

(If you're thinking "That's easy; just perform a permissions audit using dsacls, PowerShell etc.", think again. Its not that simple.)

$100 Billion side-note: A few days ago, I had posed the same question to Microsoft here. They're likely not going to answer it, so to help Microsoft, as well as 1000s of organizations worldwide, I've answered the question below.

The Answer Illustrated

The answer is best illustrated with a walk-through example. In your own best interest, I highly recommend going through it.

Let us assume that a fictional publicly-held organization is required to identify (i.e. audit) exactly who can modify the security permissions protecting the AdminSDHolder object to demonstrate regulatory compliance, since that is what determines who controls the most powerful and prized privileged/administrative accounts in an Active Directory based IT infrastructure.

To try and answer this question, lets begin by diving right in and launching Active Directory Users and Computers to locate and view the ACL on the AdminSDHolder object -

A closer look reveals that this is a modified (i.e. non-default) AdminSDHolder ACL, in which access changes have been made, as evidenced, for example, by the presence of security permissions that are specified for numerous non-default domain security groups such as IT Contingency Support Team, IT Global Admins Team etc. -

Since this is no longer a default AdminSDHolder ACL, the resulting (effective) permissions/access granted to various individuals by the various permissions specified in the ACL may now differ (likely) substantially from those granted by the default ACL!



For instance, let us consider the impact of the Special security permissions specified for the IT Contingency Support Team -

The Special permissions specified for the IT Contingency Support Team include Allow Modify Permissions and All validated writes. Since it includes Modify Permissions it impacts our answer, so its worth taking a look at the membership of this group.




A closer look at the IT Contingency Support Team indicates that there is a another domain security group nested inside it -

Upon further expansion, one finds that the IT Contingency Support Team has as a member the IT Data Center Operations Team, which in turn has as member the IT Cloud DevOps Team, which in turn has 12 users that are members of that group -

In essence, this one single Special permission alone ends up indirectly (i.e. via 3 levels of nested group nesting) granting 12 individuals Modify Permissions on this ACL.

However, it should also be noted that there could also be one or more Deny permissions in the ACL that could similarly end up denying one or more of these 12 individuals the same Modify Permissions on this ACL, and thus it is not sufficient to merely analyze any one permission in isolation. *Further any such Deny permission may or may not end up negating the Allow, because the resulting access in this case would also depend on the nature (Explicit/Inherited) of both the Allow and Deny permissions.

* By default, the AdminSDHolder ACL is protected. However, since most Active Directory deployments have been around for years, it is possible that someone could have accidentally unchecked the Protected check-box, in which case it will inherit ACEs from the parent. As experts, we take every possible scenario into account. As such, this being an illustrative example applies to most objects in Active Directory (whose ACLs are unprotected) so in most cases, when making such determinations, inherited permissions will need to be taken into account.

As such, as seen above, there are many ACEs (access control entries) in the object's ACL (access control list), each one of which allows or denies a specific security principal (which could be a user, a computer, a security group, a well-known SID etc.) one of more specific Active Directory security permissions, and each one could either have been directly (explicitly) specified on the object, or may have been inherited via inheritance of permissions from the ACL in the object's parent.

In essence, the only way to answer this question is to accurately determine the new resulting (effective) permissions/access granted on this object, which involves collectively taking into account the entirety of all permissions specified to all security principals (users, groups well-known security principals etc.), in light of their permissions types (Allow/Deny) and nature (Explicit/Inherited), to ultimately identify all individuals who effectively possess Modify Permissions permissions on this object.

Specifically, not only will one have to correctly resolve allow vs deny conflicts taking into account the explicit vs inherited nature of each permission, but one will have to expand any and all relevant security group memberships, many of which could contain multiply nested groups (some of which may be circularly nested), and if needed also dynamically evaluate any specified well-known SIDs (e.g. Authenticated Users etc.) and of course, also analyze all relevant security permissions, i.e. in this case, not only those that allow/deny Modify Permissions but also those that allow/deny Full-Control, and of course do all this (each time) with 100% accuracy and no possibility of error.

(The astute mind will have already inferred by now, why this is not a matter of simply performing an audit of "Who has what permissions in Active Directory" or writing a simple (or for that matter even a very complicated) PowerShell script to do so.)

In summary, one needs to determine effective permissions/access granted on this Active Directory object, considering all the permissions, both allowed and denied, whether granted explicitly or inherited, to all the security principals specified in the ACL.

In short, what one needs to do is accurately determine Active Directory Effective Permissions.


In fact, Active Directory Effective Permissions are so important that Microsoft provides an entire tab for it in its native tooling -

To reiterate, the fact that along with Permissions, Auditing and Owner(ship), the fourth tab in Microsoft's native Active Directory management tooling is for Effective Permissions conveys just how important effective permissions are to Windows security.


Here's a closer look at the Effective Permissions Tab in Active Directory -

Active Directory Effective Permissions Tab

As important as it is, unfortunately the Active Directory Effective Permissions Tab provided in Microsoft's native Active Directory management tooling is (and has been so for 10+ years now) substantially inadequate for the following reasons -

1. It is not always 100% accurate, since it self-admittedly does not take all relevant factors into account

2. Most importantly, it can only determine an approximation of effective permissions granted, ONE user at a time

3. Finally, it cannot identify the underlying permissions that entitle a specific user to a specific effective permission

It is for these 3 reasons that it is unable to help organizations assess and lockdown effective permissions in Active Directory, and consequently, most organizations worldwide do not yet have a definitive answer to this and other profoundly vital questions.


(Apologies for the digression.) NOW, to continue on with the example...


Let us assume that the organization has a simple one domain Active Directory forest containing 5000 employee accounts and 10,000 computer accounts, one each for 10K domain-joined computers (e.g. laptops, mail, file, web and application servers.)

Since the Active Directory Effective Permissions Tab can only determine effective permissions ONE user at a time, the only way to definitively determine the identities of all individuals in the company who effectively have Modify Permissions permissions granted on the AdminSDHolder object would be to compile a list of each of these 5000 domain user accounts and 10,000 computer accounts, and then manually enter the identities of each of these accounts ONE BY ONE -

It should be clearly evident that such a process could be very laborious and easily take an excessively long time (i.e. a few days, if not weeks) and require substantial effort, each time the organization needed to make such a determination.

It is also worth noting that in the event that it is found that a user who is not supposed to have this effective permission granted does have it nonetheless, there is no way to easily know which underlying security permission in the ACL is entitling this user to this effective permission, and without that piece of intel, it would be very difficult to revoke this identified unauthorized access.


In essence, in reality, due to the shortcomings of the Effective Permissions Tab in Microsoft's Active Directory management tooling, and a general lack of awareness about the need, value and importance of determining effective permissions in Active Directory, today most organizations have NO idea as to EXACTLY who effectively has Modify Permissions permissions on the AdminSDHolder object, and thus likely have NO clue as to exactly who can control AdminSDHolder in their Active Directory.

By the way, virtually every method described in various forums on Microsoft TechNet on how to determine effective permissions in Active Directory and/or audit delegations, is technically substantially inaccurate, as is this dangerously inaccurate free tool.

Speaking of which, not a single other Microsoft tool such as dsacls, acldiag, etc. or for that matter any other 3rd party tool can accurately determine effective permissions in Active Directory. Some do offer Active Directory Permissions Audit Tools, but those are like baby-toys compared to an Active Directory Effective Permissions Audit Tool, because with them, you're still left to do a MOUNTAIN of work yourself to determine effective permissions, assuming you know how to do so accurately.)

In essence, even though there are 100s of cyber security companies in the world, including some big ones, not a single one of them offers an Active Directory Effective Permissions Audit Tool. Hmm... so much so for demonstrating thought leadership!



So, is there NO way for organizations to accurately and efficiently calculate effective permissions in Active Directory today?

In other words, is there NO way in which 20,000+ organizations worldwide that operate on Microsoft Active Directory, whose cumulative market cap handily exceeds $10 Trillion, can today find out exactly who controls the Keys to their Kingdom(s)?




Well, (thanks to the foresight of one individual, and a decade's work by one cyber security company,) there is ONE way...



Here's how business and government organizations worldwide, including Microsoft IT, can easily, efficiently and accurately determine exactly who has what effective permissions on not just AdminSDHolder but on any object in their Active Directory:

Open Gold Finger, select the Active Directory Effective Permissions Calculator, point it to AdminSDHolder, and click a button -

Gold Finger Active Directory Effective Permissions Calculator

Within a matter of seconds, Gold Finger will uniquely and accurately determine and reveal -

1. The complete set of all effective permissions granted on the object, including of course Modify Permissions

2. For each such effective permission, the complete set of all authenticatable security principals i.e. all domain (user, computer and service) accounts that have a specific effective permission granted on the object

&

3. For each such account, the exact underlying security permissions in the object's ACL that entitle this account to this specific effective permission.

Armed with such valuable intel, organizations can finally, and likely for the first time ever, not only instantly find out exactly who controls the Keys to their Kingdom, but also lock-down access to minimize the number of individuals who can currently do so.

(Incidentally, armed with the same intel, an intruder could also very quickly uncover and exploit the easiest possible path to the Keys to the Kingdom. That is why we only license Gold Finger to legitimate organizations and only for use in their AD domains.)

(In fact Gold Finger can also automatically determine effective permissions/access across an entire domain at a button's touch to exactly find out not only who has they Keys to the Kingdom, but also who has the keys to every door in the kingdom.)




Summary

In summary, considering the fact that 100% of all major recent cyber security breaches involved the misuse and compromise of just ONE Active Directory privileged user account, and the fact that the ACL on AdminSDHolder controls the security of all default administrative (i.e. privileged) accounts and groups in Active Directory, at the very least, every organization that operates on Active Directory today must know exactly who can control the permissions specified in AdminSDHolder's ACL.

The only other thing I will add is that I find it unbelievable that in over a decade, for whatever reason, Microsoft has not once educated its customers about the vital need and importance of determining effective permissions in their foundational Active Directory deployments. Not once! I wonder what that conveys about a company trying to woo the world to embrace its Cloud.

In their own best interest, every organization must strive to understand the profound importance of what I have shared above.

This stuff is paramount to organizational cyber security today.

Best wishes,
Sanjay



PS: The Answer

In short, the simple answer to this elemental yet profoundly vital cyber security question is -

To accurately determine exactly who can modify the security permissions specified in the AdminSDHolder object's ACL, organizations need to accurately determine Active Directory Effective Permissions granted on the object.

I could've easily just shared this one-line answer, but most folks worldwide wouldn't have gotten it, thus the example.

World's Only Accurate Active Directory Privileged User/Access Audit Tool

Folks,

Hope your 2017's off to a great start. As I had indicated a few days ago, starting January 26th I'll be sharing some valuable insights on Active Directory Security; until then just wanted to get some very basic stuff out of the way; this one being the 8th.

Active Directory Privileged User/Access Audits - A Paramount Need

Today every single organization that operates on Microsoft Active Directory has a paramount cyber security need to be able to accurately audit privileged access in its foundational Active Directory deployment. What else could be more important?
A few examples of such paramount Active Directory privileged access audits include -

1. Exactly how many privileged access users do we have in our foundational Active Directory?
2. Exactly who has what privileged access in our foundational Active Directory?
3. Exactly how does someone have privileged access in our Active Directory?
4. Exactly who can manage all of our privileged users and groups in our Active Directory?
5. Exactly who has what privileged access over all our vital Active Directory domain user accounts, domain computer accounts, domain security groups, Organizational Units, etc. (and there could be 1000s of them)?

If you truly know Active Directory Security, then you know that it is not "Who has what permissions" but "Who has what effective permissions" that matters, ; the difference is colossal and could very well be the difference between security and compromise.

Most organizations do not even seem to know that they need to be able to determine effective permissions/access in Active Directory, and do so accurately, to maintain a sound cyber security posture. At those who do know, IT personnel struggle to fulfill this paramount need; they try writing advanced in-house LDAP/ PowerShell scripts, using free MS tools like dsacls, acldiag, LDP, the Effective Permissions Tab, etc., or relying on one free 3rd party audit tool that is dangerously inaccurate.

To begin with, the knowledge required to write a script that could accurately determine effective permissions on even a single Active Directory object, let alone thousands of Active Directory objects, is such a rarity that let alone most IT personnel I doubt even many $ Billion cyber security companies would know where to even begin. That said, many well-intentioned IT admins who care deeply about security do proceed to endeavor to write and use substantially inaccurate scripts to do so.

Assuming they could write an accurate script to do so, here are 5 issues/challenges that they will most likely run into -

1. In-house scripts are prone to human-error, need to be maintained and could be maliciously modified by someone.
2. The use of PowerShell, and/or utilities like LDP requires a certain level of technical Active Directory expertise.
3. The Microsoft Effective Permissions Tab is not only self-admittedly inaccurate, it is woefully inadequate.
4. All free 3rd party tools that claim to do Active Directory effective permissions are substantially inaccurate.
5. Manually attempting to determine effective permissions on thousands of Active Directory objects could take years.

It is unequivocally clear to use that what organizations need is an accurate, efficient and reliable (tamper-proof) Active Directory Privileged Access Audit Tool that could help IT personnel worldwide easily & trustworthily fulfill this paramount need.

So we built the world's only accurate Active Directory Privileged Access Audit Tool so it could help all IT admins, analysts, auditors and others easily and trustworthily fulfill their paramount Active Directory privileged user access audit needs.



Gold Finger Active Directory Administrative Access and Delegation Audit Tool

The Gold Finger Administrative Access and Delegation Audit Tool is quite simply the world's only accurate Active Directory Privileged User/Access Audit Tool. There's simply nothing quite like it in the world, and once you've used it, you'll know why -  

Gold Finger Active Directory Privileged User Access Audit Tool

If you can touch a button, you can now (for the first time ever) accurately and easily find out exactly who has what privileged access across an entire Active Directory domain, in effect accomplishing an almost impossible feat, at the click of a button!

Capability Overview

Here's a quick overview of the tool's top 10 features/capabilities -

1. Accurate Assessment – Accurately audit exactly who has what privileged access in Active Directory, taking all factors (e.g. precedence orders, memberships expansions, conflict resolution etc.) that impact effective access into account.
2. Complete Automation – Automatically audit effective privileged access across an entire Active Directory domain.
3. Enterprise Scalability – Swiftly assess effective privileged access across even large Active Directory deployments.
4. Source Identification – Find out exactly which underlying permissions grants a user specific effective privileged access.
5. Zero Configuration – Instantly deploy the tool on any machine without requiring a single change anywhere whatsoever.
6. Real-Time Analysis – Instantly audit and verify an administrative delegation as soon as it is made in Active Directory.
7. Intuitive Interface – Easily view all privileged access, all users who have such access, where they have it and how so.
8. Professional-grade Report Generation – Easily generate and furnish privileged access audit reports in PDF format.
9. Analysis Exports – Instantly export audit results for offline analysis, sharing, report submission and archival.
10. DC Specific Analysis and Alternate Credential Use – Target any domain controller, and use alternate credentials.

Design Goals

Here are the 7 main design goals we set and met for Gold Finger -

1. Accuracy - Accuracy is everything, and Gold Finger is the world's only accurate privileged access audit tool.
2. Automation - The tool must be able to automatically determine effective permissions/access across thousands of Active Directory objects accurately and quickly so organizations can obtain this paramount insight within minutes, not months.
3. Actionable Insight - The tool must deliver results in the form of actionable insight i.e. its results must be calculated and displayed in terms of entitled administrative tasks, and also show exactly who can perform them, and exactly how so.
4. Source-Identification - It can pinpoint the underlying permission that entitles a user to performing a specific task.
5. Data output - IT personnel should be able to effortlessly export the raw data for archival, rich analysis etc.
6. Ease of use - It can be installed in 2 minutes on any machine* and requires no Active Directory knowledge to use.
7. Trustworthiness - When it comes to security, Gold Finger also sets the bar and gold standard for trustworthiness.

Example Reports

Here are 10 real-world examples of the kinds of Active Directory effective permissions audits you can perform with Gold Finger -

1. Discover exactly who has unrestricted privileged access in the Corp domain.
2. Find out exactly who can create, delete, manage and control entire Organizational Units in the Corp domain.
3. Find out exactly who can manage and control all privileged and executive domain user accounts in the Corp domain.
4. Find out exactly who can change the membership of critical privileged/administrative groups such as Domain Admins.
5. Find out exactly who can manage every executive and administrative account and security group in the Corp domain.
6. Find out exactly who can create and delete domain user accounts, security groups and OUs in the Corp domain.
7. Find out exactly who can reset the passwords of all domain user accounts, including those of privileged/executive users.
8. Find out exactly who can disable the requirement to have Smart-card authentication for all domain user accounts.
9. Find out exactly who can modify or delegate administrative (privileged) access in Active Directory, where and how.
10. Uncover thousands of privilege escalation paths leading to critical privileged access across an entire Active Directory.

Trusted Worldwide

Today, our Gold Finger Active Directory Administrative Access and Delegation Audit Tool is used worldwide by the world's top organizations to easily fulfill the paramount cyber security need of being able to precisely identify privileged users and privileged access in their foundational Active Directory deployments.

Details over at - http://www.paramountdefenses.com/active-directory-administrative-access-and-delegation-audit-tool.html

Best wishes,

Sanjay