Review the membership of the high-level administrative groups
As a security best practice, it is important to limit the number of privileged accounts used in an Active Directory environment. Sometimes we add users to privileged groups temporarily to do certain tasks and then forget to remove the permissions later on. Therefore, it is important to review members of the sensitive groups periodically and update those as required. In Active Directory, the following security groups are identified as sensitive groups:
- Enterprise Admins
- Schema Admins
- Domain Admins
- Account Operators (if present)
- Server Operators (if present)
- Print Operators (if present)
- DHCP Administrators
- DNSAdmins
To review the membership of a sensitive group we can use the following command:
Get-ADGroupMember -Identity "Domain Admins"
In the preceding command, Domain Admins is the group name and it can be replaced with any other sensitive...
