Some tools that draw links between objects in a Active Directory architecture, show that if we have an user who is administrator of an OU on which a domain administrator is also present, so he can take control of the domain.

Is that true?

How is it possible if so?

1 Answer 1


Should be straightforward enough;

  1. As OU administrator, reset the domain administrator's password (as he is in your OU)
  2. Now you can log in as the domain administrator (you know the password now)
  3. Configure your account to be a domain administrator (as you're currently authenticated as a domain admin).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.