With almost all ports blocked on the domain, there is no way for intruder to remotely access domain controller and do big changes to the domain. Can anyone enlighten me on why a lot of resources are still put into protecting domain admin accounts and how much possible harm can an intruder do with domain admin account without access to DC?

  • Domain admin accounts have admin access on all the workstations as well, not just the DC. They're literally the God-tier account of the enterprise. – Ivan Aug 31 '16 at 16:16
  • Do you trust all your users? Even if you are part of a large company with 1000s of employees? One bad legitimate user could compromise the whole lot without being remote. – Matthew Aug 31 '16 at 16:17
  • If they gain access to an Domain Admin account, they can in theory, exploit any vulnerability that exists on your network. Don't say it can't happen, many companies are compromised from the very bottom and escalate their access slowly. – Ramhound Sep 1 '16 at 4:13

Maybe this will help:

You said: "With almost all ports blocked on the domain, there is no way for intruder to remotely access domain controller and do big changes to the domain."

All ports blocked? inbound or outbound? This is the idea behind rats/backdoors.

If a domain admin can control any system, they can disable a system from domain restrictions if they wanted to. Leaving them more vulnerable than you'd expect (a monitoring note). If they domain admin wanted access to the domain controller, they'd pretty much just need to backdoor or monitor a user who does have access. They can launch exploits that may require admin privs locally to exploit. Fileshare and vm escapes sell for some good monies these days. I mean, there's a whole world of possibilities. If your single point of failure is your DC, you might want to think about the platform your DC is on. Most people, it's on windows, with other services, on a shitty physical box or virtual instance. If it's in a virtual instance, that's probably within a whole other realm. People have found attackers using dns, http, smtp, irc, xmpp, smb, nss, slack web api, other web api, etc... to pull data about your enterprise out depending on abilities of your network. Some attackers have dozens of malware generators just for these types of network and will rotate between sample structures until something else works (often from phishing).

So, to answer the question, your enterprise is at stake. You don't need domain controller access, which an intruder would have better leverage to attack at with domain admin creds, to own an entire company. That hasn't been thought of as needed or required for many years. The claim that ports being blocked doesn't really change that.

If your entire network has no external access, PoC campaigns have shown that this doesn't really stop someone dedicated to taking your company.

Soo.... The reason why people put so much effort into it is because it's a baseline monitoring requirement if nothing else to attempt to protect administrative accounts that can compromise any system in your enterprise.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.