AdminCount Attribute Set on Standard Users

medium

Language:

Description

The adminCount attribute creates exceptions in global policies.

Solution

Reset the adminCount property for accounts who no longer have administrative roles.

See Also

Admin-Count attribute

Indicator Details

Name: AdminCount Attribute Set on Standard Users

Codename: C-ADMINCOUNT-ACCOUNT-PROPS

Severity: Medium

MITRE ATT&CK Information:

Tactic: TA0004 - Privilege Escalation
- Techniques: T1078 - Valid Accounts