-
Access to a Sensitive LDAP Attribute
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Tactic: Privilege Escalation Use Case: Active Directory Monitoring Data Source: Active Directory Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Rule Type: Event Correlation (EQL) Platform: Windows ·Identify access to sensitive Active Directory object attributes that contains credentials and decryption keys such as unixUserPassword, ms-PKI-AccountCredentials and msPKI-CredentialRoamingTokens.
Read More -
Account Configured with Never-Expiring Password
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Persistence Data Source: Active Directory Resources: Investigation Guide Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Noise: Medium Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Detects the creation and modification of an account with the "Don't Expire Password" option Enabled. Attackers can abuse this misconfiguration to persist in the domain and maintain long-term access using compromised accounts with this property.
Read More -
Active Directory Forced Authentication from Linux Host - SMB Named Pipes
Sep 19, 2026 · Domain: Endpoint OS: Windows OS: Linux Use Case: Threat Detection Tactic: Credential Access Data Source: Elastic Defend Data Source: Active Directory Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows Platform: Linux ·Identifies a potential forced authentication using related SMB named pipes. Attackers may attempt to force targets to authenticate to a host controlled by them to capture hashes or enable relay attacks.
Read More -
Active Directory Group Modification by SYSTEM
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Persistence Use Case: Active Directory Monitoring Data Source: Active Directory Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Medium Performance: Fast Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies a user being added to an active directory group by the SYSTEM (S-1-5-18) user. This behavior can indicate that the attacker has achieved SYSTEM privileges in a domain controller, which attackers can obtain by exploiting vulnerabilities or abusing default group privileges (e.g., Server Operators), and is attempting to pivot to a domain account.
Read More -
AdminSDHolder Backdoor
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Persistence Use Case: Active Directory Monitoring Data Source: Active Directory Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: Custom Query (KQL) Platform: Windows ·Detects modifications in the AdminSDHolder object. Attackers can abuse the SDProp process to implement a persistent backdoor in Active Directory. SDProp compares the permissions on protected objects with those defined on the AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, regaining their Administrative Privileges.
Read More -
AdminSDHolder SDProp Exclusion Added
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Persistence Data Source: Active Directory Resources: Investigation Guide Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Noise: Low Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies a modification on the dsHeuristics attribute on the bit that holds the configuration of groups excluded from the SDProp process. The SDProp compares the permissions on protected objects with those defined on the AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, meaning that groups excluded will remain unchanged. Attackers can abuse this misconfiguration to maintain long-term access to privileged accounts in these groups.
Read More -
Creation of a DNS-Named Record
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Active Directory Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Medium Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces some security issues because of the default permission (Any authenticated users) to create DNS-named records. Attackers can perform Dynamic Spoofing attacks, where they monitor LLMNR/NBT-NS requests and create DNS-named records to target systems that are requested from multiple systems. They can also create specific records to target specific services, such as wpad, for spoofing attacks.
Read More -
Delegated Managed Service Account Modification by an Unusual User
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Use Case: Active Directory Monitoring Data Source: Active Directory Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: New Terms Platform: Windows ·Detects modifications to the msDS-ManagedAccountPrecededByLink attribute of a delegated managed service account by an unusual subject account. Attackers can abuse this attribute to inherit a target account's permissions and further elevate privileges.
Read More -
dMSA Account Creation by an Unusual User
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Use Case: Active Directory Monitoring Data Source: Active Directory Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: New Terms Platform: Windows ·Detects creation of a delegated Managed Service Account by an unusual subject account. Attackers can abuse weak child-object or msDS-DelegatedManagedServiceAccount rights during account migration to elevate privileges.
Read More -
First Time Seen Account Performing DCSync
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Tactic: Privilege Escalation Use Case: Active Directory Monitoring Data Source: Active Directory Resources: Investigation Guide Data Source: Windows Security Event Logs Noise: Low Performance: Normal Rule Type: New Terms Platform: Windows ·This rule identifies when a User Account starts the Active Directory Replication Process for the first time. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain.
Read More -
Group Policy Abuse for Privilege Addition
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Data Source: Active Directory Resources: Investigation Guide Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Noise: Low Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.
Read More -
Kerberos Pre-authentication Disabled for User
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Tactic: Defense Evasion Tactic: Privilege Escalation Resources: Investigation Guide Use Case: Active Directory Monitoring Data Source: Active Directory Data Source: Windows Security Event Logs Noise: Low Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies the modification of an account's Kerberos pre-authentication options. An adversary with GenericWrite/GenericAll rights over the account can maliciously modify these settings to perform offline password cracking attacks such as AS-REP roasting.
Read More -
KRBTGT Delegation Backdoor
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Persistence Use Case: Active Directory Monitoring Data Source: Active Directory Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies the modification of the msDS-AllowedToDelegateTo attribute to KRBTGT. Attackers can use this technique to maintain persistence to the domain by having the ability to request tickets for the KRBTGT service.
Read More -
Modification of the msPKIAccountCredentials
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Data Source: Active Directory Tactic: Privilege Escalation Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: Custom Query (KQL) Platform: Windows ·Identify the modification of the msPKIAccountCredentials attribute in an Active Directory User Object. Attackers can abuse the credentials roaming feature to overwrite an arbitrary file for privilege escalation. ms-PKI-AccountCredentials contains binary large objects (BLOBs) of encrypted credential objects from the credential manager store, private keys, certificates, and certificate requests.
Read More -
Newly Observed RC4 Kerberos Service Ticket Request
Sep 19, 2026 · Domain: Identity OS: Windows Use Case: Threat Detection Tactic: Credential Access Use Case: Active Directory Monitoring Data Source: Active Directory Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Unknown Performance: Normal Rule Type: New Terms Platform: Windows ·Identifies a successful RC4-HMAC Kerberos service ticket request for a requester and service pair that has not been observed during the previous 7 days. A newly observed requester-to-service relationship involving an RC4-encrypted ticket may indicate Kerberoasting.
Read More -
PKINIT Followed by Same-Principal U2U Service Ticket
Sep 19, 2026 · Domain: Identity Platform: Windows OS: Windows Use Case: Threat Detection Tactic: Credential Access Rule Type: Event Correlation (EQL) Use Case: Active Directory Monitoring Data Source: Active Directory Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Unknown Performance: Normal Domain: Endpoint ·Identifies a successful PKINIT ticket-granting ticket request followed within five seconds on the same domain controller and source address by a successful user-to-user service-ticket request whose service SID matches the PKINIT principal SID. This sequence is consistent with the KDC-visible ticket requests used in an UnPAC-the-Hash attack, before client-side PAC credential decryption and NT hash recovery. The certificate used for PKINIT may have been obtained through CertiGhost or another certificate-abuse path.
Read More -
Potential Active Directory Replication Account Backdoor
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Active Directory Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Medium Performance: Normal Rule Type: Custom Query (KQL) Platform: Windows ·Identifies the modification of the nTSecurityDescriptor attribute in a domain object with rights related to DCSync to a user/computer account. Attackers can use this backdoor to re-obtain access to hashes of any user/computer.
Read More -
Potential ADIDNS Poisoning via Wildcard Record Creation
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Active Directory Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces some security issues, such as wildcard records, mainly because of the default permission (Any authenticated users) to create DNS-named records. Attackers can create wildcard records to redirect traffic for names that do not explicitly match records in the zone, positioning themselves as an adversary-in-the-middle and enabling credential interception or relay through ADIDNS manipulation similar in outcome to LLMNR/NBNS spoofing.
Read More -
Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121)
Sep 19, 2026 · Domain: Endpoint Domain: Identity OS: Windows Use Case: Threat Detection Tactic: Credential Access Tactic: Privilege Escalation Use Case: Active Directory Monitoring Use Case: Vulnerability Data Source: Active Directory Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Unknown Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: ES|QL Platform: Windows Vuln: CVE-2026-54121 ·Identifies successful Active Directory Certificate Services (AD CS) certificate issuance events where a machine-account requester differs from the Remote Machine Discovery (RMD) chase target while the event's DNS subject alternative name (SAN) matches that target. This requester-to-target mismatch may indicate CertiGhost (CVE-2026-54121) or similar abuse of AD CS request-context chase processing.
Read More -
Potential Computer Account NTLM Relay Activity
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Active Directory Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies potential relay activities against a Computer account by identifying authentication events using the computer account coming from from hosts other than the server that owns the account. Attackers may relay the computer account hash after capturing it using forced authentication.
Read More -
Potential Credential Access via DCSync
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Tactic: Privilege Escalation Data Source: Active Directory Resources: Investigation Guide Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Noise: High Performance: Normal Profile: Aggressive Rule Type: New Terms Platform: Windows ·This rule identifies when a User Account starts the Active Directory Replication Process. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain.
Read More -
Potential Kerberos Coercion via DNS-Based SPN Spoofing
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Active Directory Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: Custom Query (KQL) Platform: Windows ·Identifies directory-service access or creation events involving a MicrosoftDNS record that contains a base64-encoded blob matching the pattern "UWhRCA...BAAAA". This blob pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure associated with DNS-based SPN spoofing used in Kerberos coercion tradecraft. Adversaries may abuse such records to coerce victim systems into authenticating to attacker-controlled hosts while requesting Kerberos tickets for legitimate services.
Read More -
Potential Kerberos Relay Attack against a Computer Account
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Active Directory Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Windows ·Detects potential relay attacks by identifying coercion attempts followed by authentication events using a target server's computer account, originating from a different host. This may indicate that an attacker has captured and relayed Kerberos authentication material for the server's computer account to execute code on behalf of the compromised system.
Read More -
Potential Machine Account Relay Attack via SMB
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Active Directory Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies potential relay attacks against a machine account by identifying network share access events coming from a remote source.ip but using the target server computer account. This may indicate an SMB relay attack.
Read More -
Potential NTLM Relay Attack against a Computer Account
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Active Directory Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Medium Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Detects potential relay attacks by identifying coercion attempts followed by authentication events using a target server's computer account, originating from a different host. This may indicate that an attacker has captured and relayed the server's computer account hash to execute code on behalf of the compromised system.
Read More -
Potential Privileged Escalation via SamAccountName Spoofing
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Use Case: Active Directory Monitoring Data Source: Active Directory Use Case: Vulnerability Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Windows Vuln: CVE-2021-42278 ·Identifies a suspicious computer account name rename event, which may indicate an attempt to exploit CVE-2021-42278 to elevate privileges from a standard domain user to a user with domain admin privileges. CVE-2021-42278 is a security vulnerability that allows potential attackers to impersonate a domain controller via samAccountName attribute spoofing.
Read More -
Potential Shadow Credentials added to AD Object
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Active Directory Resources: Investigation Guide Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Noise: Low Performance: Normal Rule Type: Custom Query (KQL) Platform: Windows ·Identify the modification of the msDS-KeyCredentialLink attribute in an Active Directory Computer or User Object. Attackers can abuse control over the object and create a key pair, append to raw public key in the attribute, and obtain persistent and stealthy access to the target user or computer object.
Read More -
Potential WPAD Spoofing via DNS Record Creation
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Active Directory Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies the creation of a DNS record that is potentially meant to enable WPAD spoofing. Attackers can disable the Global Query Block List (GQBL) and create a "wpad" record to exploit hosts running WPAD with default settings for privilege escalation and lateral movement.
Read More -
Remote Computer Account DnsHostName Update
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Use Case: Active Directory Monitoring Data Source: Active Directory Use Case: Vulnerability Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Windows Vuln: CVE-2022-26923 ·Identifies the remote update to a computer account's DnsHostName attribute. If the new value set is a valid domain controller DNS hostname and the subject computer name is not a domain controller, then it's highly likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges.
Read More -
Scheduled Task Execution at Scale via GPO
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Tactic: Lateral Movement Data Source: Active Directory Resources: Investigation Guide Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Noise: Low Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Detects the modification of Group Policy Object attributes to execute a scheduled task in the objects controlled by the GPO.
Read More -
Sensitive Privilege SeEnableDelegationPrivilege assigned to a Principal
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Tactic: Persistence Data Source: Active Directory Resources: Investigation Guide Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Noise: Low Performance: Normal Rule Type: Custom Query (KQL) Platform: Windows ·Identifies the assignment of the SeEnableDelegationPrivilege sensitive "user right" to a security principal. This right enables computer and user accounts to be trusted for delegation. Attackers can abuse it to compromise Active Directory accounts and elevate their privileges.
Read More -
Service Creation via Local Kerberos Authentication
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Use Case: Active Directory Monitoring Data Source: Active Directory Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, followed by service creation from the same LogonId. This may indicate an attempt to leverage a Kerberos relay attack variant that can elevate privileges locally from a domain-joined user to LocalSystem privileges.
Read More -
Startup/Logon Script added to Group Policy Object
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Data Source: Active Directory Resources: Investigation Guide Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Noise: Low Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Read More -
Suspicious Access to LDAP Attributes
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Discovery Data Source: Windows Security Event Logs Data Source: Active Directory Data Source: Windows Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Rule Type: Event Correlation (EQL) Platform: Windows ·Identify read access to a high number of Active Directory object attributes. The knowledge of objects properties can help adversaries find vulnerabilities, elevate privileges or collect sensitive information.
Read More -
Suspicious Kerberos Authentication Ticket Request
Sep 19, 2026 · Domain: Endpoint Domain: Identity OS: Windows Use Case: Threat Detection Tactic: Lateral Movement Use Case: Active Directory Monitoring Data Source: Active Directory Data Source: Elastic Defend Data Source: Sysmon Data Source: Windows Security Event Logs Resources: Investigation Guide Noise: Medium Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Correlates network connections to the standard Kerberos port by an unusual process from the source machine with a Kerberos authentication ticket request from the target domain controller.
Read More -
Suspicious Remote Registry Access via SeBackupPrivilege
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Lateral Movement Tactic: Credential Access Resources: Investigation Guide Use Case: Active Directory Monitoring Data Source: Active Directory Data Source: Windows Security Event Logs Noise: High Performance: Normal Profile: Aggressive Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies remote access to the registry using an account with Backup Operators group membership. This may indicate an attempt to exfiltrate credentials by dumping the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation.
Read More -
User account exposed to Kerberoasting
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Active Directory Resources: Investigation Guide Use Case: Active Directory Monitoring Data Source: Windows Security Event Logs Noise: Medium Performance: Normal Rule Type: Custom Query (KQL) Platform: Windows ·Detects when a user account has the servicePrincipalName attribute modified. Attackers can abuse write privileges over a user to configure Service Principle Names (SPNs) so that they can perform Kerberoasting. Administrators can also configure this for legitimate purposes, exposing the account to Kerberoasting.
Read More -
User Added to Privileged Group in Active Directory
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Persistence Resources: Investigation Guide Use Case: Active Directory Monitoring Data Source: Active Directory Data Source: Windows Security Event Logs Noise: Medium Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies a user being added to a privileged group in Active Directory. Privileged accounts and groups in Active Directory are those to which powerful rights, privileges, and permissions are granted that allow them to perform nearly any action in Active Directory and on domain-joined systems.
Read More