AdminSDHolder permissions enabling privileged persistence

Sanitized Active Directory finding. Domain names, account names and exact ACLs are withheld.

Context

AdminSDHolder protects the security descriptor of privileged and protected directory objects. Changes to its permissions can propagate to high-value accounts and survive ordinary cleanup.

Finding

A delegated principal had excessive rights over the AdminSDHolder object, including the ability to alter its security descriptor. The permission was not required for the principal’s operational role.

Technical workflow

The ACL review was read-only and focused on effective permissions, inheritance and the SDProp lifecycle. In an authorized PowerShell session, the relevant object can be inspected without modifying it:

Import-Module ActiveDirectory
$dn = 'CN=AdminSDHolder,CN=System,DC=AUTHORIZED,DC=LOCAL'
Get-ADObject -Identity $dn -Properties nTSecurityDescriptor
Get-Acl "AD:\$dn" | Select-Object -ExpandProperty Access

The exported ACL was then compared with an allowlist of approved administrative principals. A small policy check is enough to catch unexpected write control:

WRITE_RIGHTS = {"WriteDacl", "WriteOwner", "GenericAll"}

def unexpected_write(entries: list[dict], allowlist: set[str]) -> list[dict]:
    return [
        entry for entry in entries
        if entry["principal"] not in allowlist
        and entry["right"] in WRITE_RIGHTS
        and entry["access"] == "Allow"
    ]

No ACL modification command belongs in a public portfolio. The evidence is the before/after descriptor, the approved delegation record and the result of the next protected-object refresh.

Impact

If the delegated identity were compromised, an attacker could use the object as a persistence mechanism and influence permissions on protected administrative accounts. This creates a path toward domain-wide privilege escalation and undermines incident response.

Remediation

• Remove unnecessary write, owner and DACL-control rights from AdminSDHolder.
• Review inheritance and protected-object ACLs after remediation.
• Alert on changes to AdminSDHolder and the AdminSDHolder-related directory objects.
• Reassess delegated administration through a least-privilege model and privileged access workstations.

Validation

Confirm the delegated identity can no longer modify the object, and verify that protected accounts receive only the intended security descriptor after the next SDProp cycle.

Also verify alerting for descriptor changes and review the event trail for the object and affected protected accounts. A clean retest requires both least privilege and detection coverage.