Haxoris Wiki

Local Administrator Rights Sprawl

How Local Administrator Rights Sprawl works

Local administrator rights sprawl is standard users holding admin on their own machines, plus support groups nested into local Administrators. That nesting, and application groups added the same way, spreads across the fleet. The membership sits in the local SAM of every host, so it never shows in a single directory query. A domain group like “Helpdesk” or “App-Deploy” gets added to local Administrators through a build image or a GPO restricted-groups policy, and from then on every host carries it whether or not that team ever touches the box.

The attacker gains the two capabilities that matter most on an endpoint: reading credential material out of LSASS, and controlling what the machine will and will not run. Local admin loads drivers, so it enables EDR tampering and vulnerable-driver abuse; it reads secrets cached by anyone who logged on since boot; and it plants persistence in services and run keys. It is easy to miss because the grant is fleet-wide and invisible - nobody reviews per-host SAM membership, the helpdesk group looks operationally necessary, and a standard user with admin on their own laptop generates no alert until the laptop is the pivot.

Local Administrator Rights Sprawl in practice

Enumerate local Administrators membership at scale

Establish who actually holds admin before judging whether it is needed. Query the local group over the segment rather than trusting the build documentation.

$hosts = Get-Content .\lab-hosts.txt   # ws01.lab.internal, ws02.lab.internal ...
foreach ($h in $hosts) {
  try {
    Get-CimInstance -ComputerName $h -ClassName Win32_GroupUser -ErrorAction Stop |
      Where-Object { $_.GroupComponent -match 'Name="Administrators"' } |
      ForEach-Object {
        [pscustomobject]@{ Host = $h; Member = ($_.PartComponent -replace '.*Name="([^"]+)".*','$1') }
      }
  } catch { Write-Warning "$h unreachable" }
} | Export-Csv .\local-admins.csv -NoTypeInformation

Attribute nested groups to a real owner

A domain group in local Administrators is the sprawl multiplier. Expand each nested group and compare its members to the team that supports the host.

Import-Csv .\local-admins.csv |
  Where-Object { $_.Member -notmatch 'Administrator$' } |
  Group-Object Member |
  Sort-Object Count -Descending |
  Select-Object Name, Count
# A "Helpdesk" or "Domain Users"-adjacent group with a host count equal to
# the fleet size is the finding: admin everywhere, need-to-know nowhere.

Show what local admin buys on one authorised host

Prove the impact with a read-only check rather than dumping live credentials. On a lab host, confirm the account can open LSASS and that tamper protection is the only thing standing between admin and the secret store.

Check (run as the sprawled account on ws01.lab.internal):

  whoami /groups | findstr /i "S-1-5-32-544"   -> BUILTIN\Administrators present
  PsGetsid / token check                        -> integrity High available via UAC
  sc.exe query WdFilter / EDR service           -> admin can query, and absent
                                                   tamper protection, stop it

Observable: the account elevates to an integrity level that can open LSASS
and unload a driver. Do not run a credential dumper on production - the ACL
test above is sufficient to record the finding. Full LSASS extraction and
detection evasion is exercised only in the isolated lab range.

Correlate admin holders against machine ownership

The need-to-know case is made by the join, not the raw list. Match each admin holder to the assigned user or support team of the host.

# admin holders vs asset owner export (asset_id,host,primary_user,support_team)
join -t, -1 1 -2 2 \
  <(sort -t, -k1 local-admins-hostuser.csv) \
  <(sort -t, -k2 asset-owners.csv) \
  | awk -F, '$2 != $5 { print $0 "  <- admin but not owner/support" }'

How to fix and prevent Local Administrator Rights Sprawl

  1. Remove standing admin from standard users
    • Strip interactive users from local Administrators; grant elevation through a brokered just-in-time flow scoped to one host and time-boxed.
    • Partial control only: elevation-on-demand still needs approval and logging, or it recreates the same rights quietly.
  2. Replace fleet-wide nested groups with per-role scoping
    • A support team gets admin on the hosts it supports via a targeted group, not on every machine through one restricted-groups policy.
  3. Turn on tamper protection and driver blocklisting
    • So that where admin remains, it cannot trivially unload the EDR or load a known-vulnerable driver; treat this as containment, not a substitute for removal.
  4. Baseline and alert on local Administrators membership
    • Export membership on a schedule, diff against the approved set, and alert on any change outside a change window.
  5. Report and review admin holders against machine ownership
    • Recertify the who-holds-admin-where join periodically; an admin with no support or ownership relationship to the host is removed.

Last updated

References