Demos / Security and compliance
Demo · 1:04
Who has admin rights?
Two risky Active Directory admins found, removed on one ticket, checked again, and the check scheduled every month.
Recorded on the real product against our demo company, Lakefront Works. The people and data are fictional.
Transcript
Attackers go after admin accounts first. So Sasha checks who really has admin rights in Lakefront's Active Directory. One run follows every admin group, including groups inside groups. Two findings stand out. The leg lamp service account is a Backup Operator, its password never expires, and it has a service name, so anyone in the company could crack its password offline. And Rachel Phelps's account is disabled, but still in Domain Admins. The last two are the IT team's own admin accounts. She takes both out of their admin groups in one run, on the same ticket. If a service breaks, the run log can put them back.
Run it again. Two admin accounts left, and a note that the two removed accounts still carry the old admin flag, for a careful clean-up later. Then she schedules it for the first of every month, so a new admin never goes unnoticed for long.