Local Administrator vs Domain Administrator: Boundaries and Escalation Paths

Privilege Isolation Axiom

• Being a local administrator on a host grants zero inherent authority over Active Directory.
• A Domain Administrator only administers a member workstation because explicit group nesting placed the domain group inside the host’s local Administrators group.

The security boundary of a member machine is subordinate to but distinct from the domain boundary.

Concept

A frequent source of critical misjudgments during incident triage is the ambiguous usage of the title “Administrator”:

1. Local Administrator: Holds total control over a single operating system instance. Its blast radius terminates strictly at the host boundary.
2. Domain Administrator: Holds administrative authority over the central Active Directory database and, by default configuration, over member hosts that trust the domain.

---

Why This Matters in DFIR

Incident responders must answer two vital triage questions:

• Question 1: “The adversary gained local administrator access on WEB01. Is the domain compromised?”
  • Answer: Not automatically. The host is compromised, but the attacker has zero direct directory rights.
• Question 2: “What technical mechanisms allow the attacker to pivot from local host administrator to Domain Administrator?”
  • This is the essence of lateral movement. The adversary abuses local administrative control to harvest credentials (LSASS memory dumps, cached Kerberos TGTs, DPAPI secrets) deposited by domain administrators logging into the compromised host.

---

How It Works

The Default Group Nesting Chain

Why does a Domain Admin have administrative rights on a member workstation? When an endpoint joins a domain:

1. The Windows client connects to the Domain Controller.
2. The domain security group DOMAIN\Domain Admins is automatically nested inside the host’s local BUILTIN\Administrators group.
3. If an administrator removes Domain Admins from BUILTIN\Administrators on an endpoint, domain admins lose local administrative control on that specific machine.

┌─────────────────────────────────────────┐
│               Active Directory          │
│                                         │
│   [Group: Domain Admins] (RID 512)      │
└────────────────────┬────────────────────┘
                     │ (Nested during domain join)
                     ▼
┌─────────────────────────────────────────┐
│          Member Host (FS01)             │
│                                         │
│   [Local Group: Administrators] (544)   │
│       ├── LOCAL\Administrator (RID 500) │
│       └── DOMAIN\Domain Admins (RID 512)│
└─────────────────────────────────────────┘

---

Lateral Escalation: From Local Admin to Domain Dominance

Local Host Compromise (Host A)
            │
            ├─► 1. LSASS Harvesting (Dumping plaintext / hashes / tickets of logged-on Domain Admins)
            ├─► 2. Pass-the-Ticket (Extracting active Kerberos TGTs from memory)
            ├─► 3. Credential Reuse (Identical local administrator passwords across the fleet)
            └─► 4. Service Account Abuse (Extracting T1/T0 service tokens or unconstrained delegation)

1. LSASS In-Memory Harvesting: If a Domain Admin connects via RDP (Logon Type 10) or interactive logon (Type 2), their Kerberos tickets or NTLM hashes reside in lsass.exe. The local admin extracts them using Mimikatz or lsassy.
2. Fleet-Wide Pass-the-Hash (LAPS Absences): If local Administrator shares a single password across endpoints, the adversary moves laterally host-by-host until discovering an active Domain Admin session.
3. Unconstrained Kerberos Delegation: If the host has TRUSTED_FOR_DELEGATION enabled, any domain user connecting to it deposits a forwardable TGT into host memory.

---

What Is Possible

• Stripping Domain Admins from Endpoints: Under clean Tiering models, domain admins must never be permitted to log into Tier 2 workstations.
• Network Sniffing by Local Admins: Local admins can deploy packet sniffers or ARP spoofers to intercept domain authentication handshakes on the wire.
• Targeted Host Quarantine: Incident responders can disable the host’s COMPUTER$ account on the DC, cutting all domain Kerberos tickets.

---

What Is Not Possible

• Querying ntds.dit as Local Admin: Outbound RPC/SMB requests from a local admin account reach the DC as anonymous or fail authentication.
• Injecting Local Hashes into a DC: The Domain Controller rejects SAM hashes originating from foreign machine SIDs.
• Local Password Changes Affecting Active Directory: Modifying a local SAM user password has zero impact on domain user accounts.

---

Forensic Artifacts

• Event ID 4624 (Logon Type 2 or 10): High-priority indicator when TargetDomainName == DOMAIN and user is a Domain Admin on an unhardened endpoint.
• Sysmon Event ID 10: Process access events targeting lsass.exe from suspicious callers (procdump.exe, rundll32.exe, powershell.exe).

---

Key Takeaways

1. A local administrator has zero direct rights over Active Directory.
2. The presence of a Domain Admin on an untrusted endpoint bridges local compromise into domain takeover.
3. Enterprise Tiering models strictly prohibit high-privilege credentials on lower-tier assets.
4. LAPS neutralizes lateral movement via local password reuse.

---

Cross References

• Doc 01: Windows Identities: Local Accounts vs Domain Accounts
• Doc 03: Built-in Accounts and Privileged Accounts
• Doc 20: Local Accounts on Domain-Joined Machines
• Doc 24: Lateral Movement Across Active Directory Domains