Posture check · Account security
Forest with more than 50 privileged accounts (T1078)
Every privileged account is a path to control of the forest.
Why it matters
Each extra account is another target, and a large set is harder to watch. One compromised admin is enough to take the forest.
How GraphnAI finds it
It runs after every sync, across all your connected domains at once. It applies to Active Directory and Microsoft Entra ID.
It reads:
- The privilege tier classification
- The forest each domain belongs to
Tiered Fidelity™ level: Theoretical
Every finding from this check carries the Theoretical level.
- TheoreticalThis checkConfigured in the directory. Nothing else checked.
- ConstrainedA constraint on it has been checked.
- ValidatedTelemetry has seen it in use.
How Select Fire™ fixes it
How to fix it
Reduce standing privilege: move members out of Tier 0 groups, adopt just-in-time elevation, and keep the permanent privileged population small and reviewed.
What Select Fire changes
Select Fire opens from the finding and simulates each change on your live graph before anything changes in your directory.
- Remove group membershipSemi-Auto: you authorize each change. Full-Auto never runs it.
Removing a privileged group membership changes what this account can reach. The access plan shows the effect before anything runs.
By hand: Remove privileged access from accounts that don't need it. The finding clears when the forest has 50 or fewer privileged accounts.
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.