Hi guys we are tasked with trying to reduce the number of domain admins in our network.
Let's say we have A list of 30 users who are members of domain admins.
How could we identify if these users have not performed a task that requires domain admin membership in the past 6 months?
By doing something like this, we could justifying removing these users from the domain admin group.
Transferring FSMO roles is done when an admin wants to split roles between certain Domain Controllers or the Domain Controller holding the Roles has been forcefully demoted using dcpromo / forceremoval
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…