Unassuming access over Domain Controller VMs means to gaining privileged access in Active Directory.

Question

Hi Everyone,

I met with new security incident in my environment. I will try to explain.

Domain User 'A' without having any administrator rights in Active Directory but in Azure same user have Virtual Machine Contributor role over Domain Controllers VM.

Now, domain user 'A' can add any Domain user into Domain Administrator group. :-(

I do not aware whether this is known behavior or any solution exist around this.

Please help me to find a way.

Thank you!

Answer 1

Hi

may be unrelated, but this post by MVP Jeffrey Appel may shed some light on this. If you are running Azure Arc in your Hybrid environment and have your Domain Controllers onboarded, then any Arc Admin level gives you full admin rights in the on-premises environment.

https://www.linkedin.com/feed/update/urn:li:activity:7071970201847615488/

May be worth a look - I know this is also Defender-related as well.

Hope this helps,

Thanks

Michael Durkan

• If the reply was helpful please upvote and/or accept as answer as this helps others in the community with similar questions. Thanks!