← All notes

The help desk could reset a Domain Admin’s password

I gave the help desk the right to reset passwords and nothing else. Testing what it couldn’t do showed it could take over the domain.

Area: Active Directory
Project: Windows AD homelab

What I saw

While testing a password-reset ticket as Maya, a help desk user, I also checked that she couldn’t reset the password of adm.ethan.brooks, an IT admin account that is a Domain Admin. She could. With that, Maya could have signed in as a Domain Admin and taken over the whole domain.

Why it happened

I had created the adm.* admin accounts inside the IT department’s OU, and the help desk’s “reset password” delegation covers every account under that part of the tree. Windows does protect Domain Admin accounts with a background process, AdminSDHolder (SDProp), that strips inherited permissions, but it only runs every 60 minutes, and the account was newer than that.

How I found it

Testing the negative case on purpose: after each delegation I tried things the help desk should not be able to do, signed in as a help desk user.

The fix

A dedicated Admin Accounts OU outside any help desk delegation, and the admin accounts moved into it. Then I re-tested as Maya:

PS> Set-ADAccountPassword adm.ethan.brooks -Reset ... -Credential $maya
Denied: Access is denied

My user-creation script now puts admin accounts in that OU from the start.

Lesson: delegation flows down to everything in the OU. Keep privileged accounts in their own OU, and test what the help desk can’t do as well as what it can.