What are some of the groups that are protected with AdminSDHolder?

Protected groups include privileged groups such as Domain Admins, Administrators, Enterprise Admins, and Schema Admins. This also includes other groups that give logon rights to domain controllers, which can be enough access to perpetrate attacks to compromise the domain.

What is the protected users group?

Protected Users is a new global security group to which you can add new or existing users. Windows 8.1 devices and Windows Server 2012 R2 hosts have special behavior with members of this group to provide better protection against credential theft.

How do I find an AdminSDHolder?

Navigate to the ‘system’ container under the domain and right-click on the sub-container called AdminSDHolder and select properties. The Security tab displays the ACL that will be applied to all members of protected groups.

What is protected group in AD?

This security group is designed as part of a strategy to manage credential exposure within the enterprise. Members of this group automatically have non-configurable protections applied to their accounts. Membership in the Protected Users group is meant to be restrictive and proactively secure by default.

Where is the AdminSDHolder object?

Active Directory domain
AdminSDHolder is automatically created as an object in the System container of every Active Directory domain. Its path is: CN=AdminSDHolder,CN=System,DC=,DC=?.

When would you use a protected user group?

The Protected Users group first appeared in Windows Server 2012 R2 and can be used to restrict what members of Active Directory privileged groups can do in the domain. Protected Users is a global security group and its primary function is to prevent users’ credentials being abused on the devices where they log in.

What is protected account?

A ‘Protected account’ is a set of rules allowing you to define network access conditions. A ‘protected account’ can be defined for a user account, a group or an organizational unit and offers: Limits on the maximum number of concurrent sessions or initial access points.

How do I see all privileged users in Active Directory?

8 Different Methods to Identify Privileged Users

Open “Active Directory Users & Computers” on the Domain Controller.
Select “Built-in” container, right-click on any of the above groups in the right pane, and open its “Properties” windows.
Go to the “Members” tab; there you will see all members of this group.

What is a protected user?

The Protected Users security group was introduced with Windows Server 2012 R2 and continued in Windows Server 2019. This group was developed to provide better protection for high privileged accounts from credential theft attacks. Members of this group have non-configurable protection applied.

What is a protected group in Active Directory?

When an Active Directory group is marked a protected group; Active Directory will ensure that the owner, the ACLs and the inheritance applied on this group are the same as the ones applied on AdminSDHolder container. The same is applied on the protected group members.

What happens if the protected accounts and groups don’t match adminsdholder permissions?

If the permissions on any of the protected accounts and groups do not match the permissions on the AdminSDHolder object, the permissions on the protected accounts and groups are reset to match those of the domain’s AdminSDHolder object.

What is the purpose of adminsdholder in Active Directory?

The following table contains the protected groups in Active Directory listed by domain controller operating system. The purpose of the AdminSDHolder object is to provide “template” permissions for the protected accounts and groups in the domain.

How to exclude a group from adminsdholder?

The following Groups could be excluded from AdminSDHolder: Doing this exclusion could be done by updating dsHeuristic flag. You can use ADSI Edit to update it under the Configuration partition and you will find it in the properties of CN=Directory Services,CN=Windows NT,CN=Services,CN=Configuration,DC=domain,DC=com.