How to Find High-Privileged Admin Accounts in Active Directory

When it comes to protecting highly privileged accounts in Active Directory, monitoring their login history is essential. It helps uncover early signs of admin account compromise, such as repeated failed sign-ins, unusual login times, and access from unauthorized systems. This enables you to detect suspicious activity quickly and take necessary action before it leads to directory compromise.

Before you begin, enable user logon auditing to retrieve the complete logon history of Active Directory administrators. This policy starts recording events only after it is enabled, so previous logons will not appear in the report.

Audit Active Directory admin logins using Event Viewer

• Open Server Manager, go to Tools»Event Viewer and from the left pane, navigate to Windows Logs»Security.
• From the Actions pane on the right, select Filter Current Log, switch to the XML tab, enable Edit query manually.
• Confirm the prompt by selecting Yes and paste the query given below. 

<QueryList> 
  <Query Id="0" Path="Security"> 
    <Select Path="Security"> 
      *[System[(EventID=4624 or EventID=4625)]] and 
      *[EventData[Data[@Name='TargetUserName']='<AdminName>']] 
    </Select> 
  </Query> 
</QueryList>

Audit Active Directory admin logon activities using PowerShell

The above method works well for retrieving the logon history of specific admin accounts. However, in large enterprises with multiple admins, manually specifying one or more admin accounts can be time-consuming and inefficient. In such cases, you need a more reliable approach to track logon events for all users in Active Directory privileged groups. To streamline this process, you can use the PowerShell script below to retrieve the logon history of all privileged Active Directory administrators. This script collects logon events for all admin accounts and exports the results to a CSV file.

$AdminGroups = "Domain Admins","Enterprise Admins","Schema Admins","Administrators"
$GroupObj = foreach ($Group in $AdminGroups) {
    try {
        Get-ADGroup -Identity $Group -ErrorAction Stop
    }
    catch {
        continue   # silently skip groups that don't exist
    }
}
$Computers = Get-ADComputer -Filter * -Properties DNSHostName |
             Where-Object { $_.DNSHostName } |
             Select-Object -ExpandProperty DNSHostName
$Admins = $GroupObj | ForEach-Object { Get-ADGroupMember $_ -Recursive } | Where-Object { $_.ObjectClass -eq "user" } | Select-Object -Unique Name, SamAccountName, Groups  
$LogonHistory = foreach ($Computer in $Computers) {
    Get-WinEvent -ComputerName $Computer -FilterHashtable @{ 
        LogName   = "Security" 
        Id        = 4624,4625 
        StartTime = "<StartDate>" 
        EndTime   = "<EndDate>" 
    } -ErrorAction SilentlyContinue | ForEach-Object { 
        $Event = $_  
        foreach ($Admin in $Admins) {  
            if ($Event.Message -match "\b$($Admin.SamAccountName)\b") {  
                [PSCustomObject]@{  
                    Name           = $Admin.Name  
                    SamAccountName = $Admin.SamAccountName
                    Groups       = $Admin.Groups  
                    EventID        = $Event.Id  
                    TimeCreated    = $Event.TimeCreated 
                    LogonComputer = $Event.Machine 
                    EventLoggedDC = $Computer 
                    Message        = ($Event.Message -split "`r?`n")[0] 
                }
            }
        }
    }
}
$LogonHistory | Export-Csv -Path "<FilePath>.csv" -NoTypeInformation

Replace <StartDate> and <EndDate> with the desired audit search range in YYYY/MM/DD format and specify a suitable name for the <FilePath> export file.

You can also schedule this script using Task Scheduler to collect logon history regularly for continuous monitoring of privileged accounts.

When administrator accounts can sign in without restrictions, it becomes difficult to differentiate legitimate activity from malicious behaviour. To reduce this risk, it is essential to control how and where admin accounts can log on. This can be achieved through Group Policy, which provides a scalable and consistent method to enforce restrictions and block unauthorized administrative access across the environment.

These GPOs should be applied to the OUs that contain the specific member servers and workstations where admin logon restrictions are required. Therefore, it is important to create a separate OU for the target member servers and workstations. Once this OU is created, you can apply the below recommended GPO-based logon restrictions to secure Active Directory administrator accounts.

Configure logon restrictions for privileged admin accounts using GPO

Follow the steps below to apply logon restrictions to members of high privileged groups using Group Policy Objects.

Imagine a helpdesk technician trying to fix a user issue but getting blocked due to insufficient permissions. While granting Domain Admin access may seem like the quickest solution, it introduces unnecessary privileges and increases security risk. This is where delegated permissions come in. Delegation enforces the principle of least-privilege and allows users to perform only the tasks they need, while keeping the environment secure. Delegated permissions allow you to assign built-in common administrative tasks to users, or create custom tasks based on specific operational requirements.

Here's how to provide delegated permissions for a user using ADUC console.

Assign delegated permission for a common task using Delegation of Control Wizard

Follow the steps below in the ADUC console to delegate a common task to a user using the Delegation Wizard.

Assign a custom task to a user in Delegation of Control Wizard

To assign a custom task to a user, follow the steps below.