Edit

Security assessment: Remove access rights on suspicious accounts with the Admin SDHolder permission

  • Article

This article describes the Remove access rights on suspicious accounts with the Admin SDHolder permission security assessment, which highlights risky access rights on suspicious accounts.

Why might the Admin SDHolder permission be risky?

Having non-sensitive accounts with Admin SDHolder (security descriptor holder) permissions can have significant security implications, including:

  • Leading to unauthorized privilege escalation, where attackers can exploit these accounts to gain administrative access and compromise sensitive systems or data
  • Increasing the attack surface, making it harder to track and mitigate security incidents, potentially exposing the organization to greater risks.

How do I use this security assessment to improve my organizational security posture?

  1. Review the recommended action at https://security.microsoft.com/securescore?viewid=actions for Remove access rights on suspicious accounts with the Admin SDHolder permission.

    For example:

    Screenshot of the Admin SDHolder security assessment.

  2. Review the list of exposed entities to discover which of your non-sensitive accounts have the Admin SDHolder permission.

  3. Take appropriate action on those entities by removing their privileged access rights. For example:

    1. Use the ADSI Edit tool to connect to your domain controller.
    2. Browse to the CN=System> CN=AdminSDHolder container and open the CN=AdminSDHolder container properties.
    3. Select the Security tab > Advanced, and remove any non-sensitive entities. These are the entities marked as exposed in the security assessment.

    For more information, see Active Directory Service Interfaces and ADSI Edit documentation

To achieve the full score, remediate all exposed entities.

Note

While assessments are updated in near real time, scores and statuses are updated every 24 hours. While the list of impacted entities is updated within a few minutes of your implementing the recommendations, the status may still take time until it's marked as Completed.

The reports show the affected entities from the last 30 days. After that time, entities no longer affected will be removed from the exposed entities list.

Next steps