Why Tier 0 Still Falls: Practical Active Directory Hardening Beyond Default Group Scrutiny

#The High-Value Target Illusion: Defense Beyond 'Domain Admins'#link

During the 2023 MGM Resorts intrusion, attackers did not breach the perimeter by cracking the Domain Admin password on a domain controller. They targeted identity infrastructure laterally, abusing delegated permissions, hybrid identity flows, and workstation-credential remnants to seize total administrative control. Most defenders spend 90% of their auditing cycles looking at the members of Enterprise Admins and Domain Admins, completely ignoring the structural ACL relationships, credential exposure chains, and delegation configurations that create unmonitored Tier 0 identities.

Unconstrained and Constrained Delegation: Token Extraction at Rest

Kerberos delegation exists to solve multi-tier application authentication, allowing a web service to impersonate an authenticated user to an internal SQL cluster. However, Unconstrained Delegation (indicated by the `TRUSTED_FOR_DELEGATION` flag in userAccountControl) forces a connecting user's Ticket Granting Service (TGS) and their primary Ticket Granting Ticket (TGT) directly into the hosting service's LSASS process memory. If an attacker compromises a server configured with unconstrained delegation, they simply coerce an authentication from a Domain Controller using the PrinterBug (MS-RPRN) or PetitPotam (MS-EFSR), extract the DC machine account's TGT from LSASS, and execute DCSync.

Auditing Vulnerable Delegation Accounts with ActiveDirectory PowerShell

Finding accounts with unconstrained delegation must be a weekly automated query, not an annual third-party audit item. The following PowerShell snippet locates non-Domain Controller computer accounts and user accounts permitted to extract TGTs into local memory:

The Shadow Admin Problem: Hidden Paths to Domain Compromise

A shadow admin is an identity with explicit discretionary access control list (DACL) rights granting functional domain ownership without membership in privileged Active Directory groups. Rights such as `GenericAll`, `WriteDacl`, `WriteOwner`, or `GenericWrite` on an Organizational Unit containing administrative accounts give an attacker the ability to rewrite group memberships or force-reset credentials. Attackers running tools like BloodHound or Sharphound seek these DACL chains specifically because SIEM rules focused on event ID 4728 (member added to security-enabled global group) fail to trigger when an access right is altered directly on an object.

Mitigating the Tier Collapse: Authentication Policies and Silos

Relying strictly on administrative tiering policies documented in runbooks fails in production. Administrators inevitably log into a Tier 1 application server or a Tier 2 workstation with their Tier 0 credentials during an incident. The moment an administrative session touches a Tier 1 or Tier 2 asset, LSASS retains the plaintext credential, Kerberos tickets, or NTLM hashes, enabling tools like Mimikatz to scrape them via `sekurlsa::logonpasswords` or handle duplication.

Active Directory Authentication Silos and Authentication Policies (introduced in Windows Server 2012 R2 functional levels) programmatically enforce credential boundaries at the Kerberos Key Distribution Center (KDC) layer. Even if an administrator types their Tier 0 domain credentials into an unauthorized host, the domain controller outright refuses to issue a Kerberos ticket unless that specific computer account belongs to the corresponding Authentication Silo.

Immediate Action Items for Blue Teams

• ▪Flag sensitive accounts with 'Account is sensitive and cannot be delegated' (sets userAccountControl NOT_DELEGATED bit, preventing ticket caching during lateral delegation).
• ▪Enable AES-128 and AES-256 exclusively for Kerberos support; explicitly audit and remove RC4-HMAC to kill Kerberoasting vulnerability margins on Tier 0 assets.
• ▪Deploy Privileged Access Workstations (PAWs) stripped of internet access, and establish GPO user rights assignments removing 'Allow log on locally' and 'Access this computer from the network' for Tier 0 accounts on any machine outside Tier 0.
• ▪Audit Active Directory AdminSDHolder container ACLs; rogue permissions applied here replicate downstream to all protected groups every 60 minutes via SDProp.