Posture check · Delegation and Kerberos
Exchange permissions group can change the domain's permissions (T1222.001)
This group looks like the one Exchange creates, and it can change the domain's permissions. A 2019 Exchange update removes this right.
Why it matters
Anyone who controls an Exchange server or this group can give themselves the right to read every password in the domain.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Active Directory.
It reads:
- The directory attributes
objectSid,userAccountControlandaccountEnabled - Directory permissions (access control entries)
- The privilege tier classification
Tiered Fidelity™ level: Constrained
Every finding from this check carries the Constrained level.
- TheoreticalConfigured in the directory. Nothing else checked.
- ConstrainedThis checkA constraint on it has been checked.
- ValidatedTelemetry has seen it in use.
Why there's no automatic fix
Select Fire has no step for this check, so the fix is by hand.
How to fix it
Apply the Exchange update that reduces this group's rights, then run Exchange's directory preparation again.
By hand: Reduce the Exchange group's rights on the domain. Install a current Exchange cumulative update and run its Active Directory preparation step, which reduces this group's rights on the domain. Removing the right by hand can break Exchange.
If someone uses it
This detection rule raises an alert when the attack this exposure invites shows up in your domain controllers' events.
Related checks
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.