Remediation Action Catalog: Auto-Remediation Actions for Active Directory and Entra ID

Overview

This catalog lists the auto-remediation actions Select Fire runs in Semi-Auto and Full-Auto. You choose the change in Select Fire, simulate it, and authorize it. The change is then made in the directory for you, so you don't copy a script and run it by hand.

Every action:

Is checked against the safety rails before anything is sent
Records the object's state before and after the change
Writes a permanent entry to the remediation history

An action with several steps, such as quarantining an account in both Active Directory and Entra ID, runs its steps in order. See Cross-Platform Identity Quarantine.

[!NOTE] Safe Mode, which gives you a script to run yourself, doesn't need the credentials in this guide. This guide covers the actions GraphnAI runs for you.

Prerequisites

Remediation credentials: An Admin sets up a write account for each domain before any action can run. See Configuring Remediation Credentials.
Entra ID write app: Entra ID actions need a separate app registration with write permissions. See Entra ID write app registration.
Bridge connected: Active Directory actions run through the domain's Identity Bridge.

Requesting Least-Privilege Provisioning

Not yet available. Least-privilege provisioning, which finds the safest way to grant access, isn't available in Graphne or Select Fire yet. Select Fire removes access only.

When it arrives, it will compare the ways to grant the same access (a group membership, a direct permission, or a role assignment). It will simulate each one, flag any path through a Critical Junction, and rank them by the Operational Safety Metric™.

Executing Remediation Actions

After you review a simulation in Select Fire, choose Semi-Auto or Full-Auto to run the action. Each action is checked against the safety rails, its current state is captured, and it's sent to the bridge (for Active Directory) or to Microsoft Graph (for Entra ID).

Each table lists the action as Remediation History names it, its type name, what it does, and whether undo can reverse it. See Reversibility Badges for what the undo classes mean.

Supported action types

Active Directory: account flags

Action	Type	What it does	Undo
Disable user	`DISABLE_USER`	Sets bit 0x0002 (ACCOUNTDISABLE) in `userAccountControl`, so the account can't authenticate	Reversible
Enable user	`ENABLE_USER`	Clears bit 0x0002 (ACCOUNTDISABLE), so a disabled account can authenticate again	Reversible
Block delegation	`SET_NOT_DELEGATED`	Sets bit 0x100000 (NOT_DELEGATED), so the account can't be used for Kerberos delegation	Reversible
Allow delegation	`CLEAR_NOT_DELEGATED`	Clears bit 0x100000 (NOT_DELEGATED)	Reversible
Require smart card	`SET_SMARTCARD_REQUIRED`	Sets bit 0x40000 (SMARTCARD_REQUIRED), so interactive logon needs a smart card	Partly reversible: the previous password can't be restored
Clear smart card requirement	`CLEAR_SMARTCARD_REQUIRED`	Clears bit 0x40000 (SMARTCARD_REQUIRED)	Reversible from saved state

Active Directory: Kerberos and password policy flags

Action	Type	What it does
Require Kerberos pre-authentication	`CLEAR_PREAUTH_NOT_REQUIRED`	Clears the pre-authentication exemption (DONT_REQ_PREAUTH), which AS-REP Roasting depends on. An old Kerberos client that can't pre-authenticate stops working. Modern Windows clients always can.
Stop storing a recoverable password	`CLEAR_REVERSIBLE_ENCRYPTION`	Clears reversible encryption (ENCRYPTED_TEXT_PWD_ALLOWED). The recoverable copy stops being written from the next password change, so pair it with requiring a password change.
Allow modern Kerberos encryption	`CLEAR_DES_ONLY`	Clears the DES-only restriction (USE_DES_KEY_ONLY). A client that speaks only the older algorithm stops working. The stronger keys exist only after a new password is set, so pair it with requiring a password change.
Require a password	`CLEAR_PASSWORD_NOT_REQUIRED`	Clears the no-password-required exemption (PASSWD_NOTREQD). It takes effect at the next password change, and nothing stops working right away.
Let the password expire	`CLEAR_PASSWORD_NEVER_EXPIRES`	Clears password-never-expires (DONT_EXPIRE_PASSWORD). If the password is already older than the policy allows, it expires at once.

All five are Reversible. Each has a matching reverse action, such as "Exempt from Kerberos pre-authentication", that undo uses. You never choose a reverse action yourself. See Remediation Reversibility and Undo.

Active Directory: attributes

Action	Type	What it does	Undo
Remove service principal name	`REMOVE_SPN`	Removes one service principal name (SPN) from the account, which shrinks what Kerberoasting (T1558.003) can target	Reversible from saved state
Add service principal name	`ADD_SPN`	Adds a service principal name	Reversible
Clear adminCount	`CLEAR_ADMIN_COUNT`	Sets `adminCount` to 0 on a demoted account, so AdminSDHolder stops applying its protected-account permissions to it	Reversible from saved state
Reset password	`RESET_PASSWORD`	Sets a new password over LDAPS (the `unicodePwd` attribute, which needs TLS)	Not reversible
Change constrained delegation	`MODIFY_CONSTRAINED_DELEGATION`	Updates `msDS-AllowedToDelegateTo` to limit where the account can delegate	Reversible from saved state
Require a password change	`FORCE_PASSWORD_CHANGE`	Requires a new password at next logon (sets `pwdLastSet` to 0). Anything running as the account fails until someone sets one, so it applies to user accounts only.	Partly reversible: the original `pwdLastSet` value isn't restored
Remove a SID history entry	`REMOVE_SIDHISTORY`	Removes one value from the account's `sIDHistory`, which withdraws every access the account held through it	Not reversible: putting a value back needs a trust relationship and admin rights on the target domain

Active Directory: structure and permissions

Action	Type	What it does	Undo
Move to another organizational unit	`MOVE_TO_OU`	Moves the account to a different organizational unit	Reversible from saved state
Remove GPO link	`REMOVE_GPO_LINK`	Removes one Group Policy link from a container's `gPLink` attribute. Settings the policy already applied stay on the computers.	Reversible from saved state (undo is "Re-link GPO")
Remove group membership	`REMOVE_MEMBER`	Removes the subject from a group	Reversible from saved state
Remove the permission	`REMOVE_ACE`	Removes one permission entry (ACE), or one right within it, from an object's DACL, including DCSync. See AD Permission Revocation.	Reversible from saved state (undo is `ADD_ACE`, "Restore the permission", which puts the entry back at its original position)

Active Directory: delegation settings. Run from a Security Posture finding. They run in Semi-Auto only. See Fix Kerberos Delegation Findings.

Action	What it does	Undo
Remove an account allowed to act on this object	Removes one account from the object's RBCD setting (`msDS-AllowedToActOnBehalfOfOtherIdentity`)	Reversible from saved state
Clear resource-based delegation	Clears the whole RBCD setting	Reversible from saved state
Clear unconstrained delegation	Clears the TRUSTED_FOR_DELEGATION flag	Reversible
Clear protocol transition	Clears the TRUSTED_TO_AUTH_FOR_DELEGATION flag	Reversible

Each has a matching restore action that only runs as an undo. Domain controllers and read-only domain controllers are refused.

Container mode. Run from the Delegation Risk page, REMOVE_ACE can remove the entries that grant a trustee the selected rights at a container in one change, including the copies that apply to the objects below it. It runs in Semi-Auto only, and its undo (ADD_ACE) restores every removed entry at its original position. See Container Removals for the directory update status.

Entra ID (run through Microsoft Graph with the Entra ID write app)

Action	Type	What it does	Undo
Block Entra sign-in	`ENTRA_BLOCK_SIGN_IN`	Sets `accountEnabled: false`, which blocks every new sign-in	Reversible
Allow Entra sign-in	`ENTRA_UNBLOCK_SIGN_IN`	Sets `accountEnabled: true`	Reversible
Revoke Entra sessions	`ENTRA_REVOKE_SESSIONS`	Calls `revokeSignInSessions`, which invalidates every active token and session	Not reversible
Remove directory role assignment	`ENTRA_REMOVE_ROLE_ASSIGNMENT`	Deletes a directory role assignment	Reversible from saved state
Remove app role assignment	`ENTRA_REMOVE_APP_ROLE`	Removes an app role assignment	Reversible from saved state
Remove OAuth permission grant	`ENTRA_REMOVE_OAUTH_GRANT`	Deletes an OAuth delegated permission grant	Reversible from saved state

Across both directories

Action	Type	What it does	Undo
Quarantine the account	`QUARANTINE_IDENTITY`	Disables the AD account, then, for a hybrid account, blocks Entra sign-in and revokes Entra sessions	Partly reversible: revoked sessions can't come back

Cross-Platform Identity Quarantine

Quarantine the account isolates a hybrid identity (Active Directory and Entra ID) during an active attack. It runs three steps in order:

Disable the AD account: The identity can't authenticate to on-premises resources.
Block Entra sign-in: The identity can't get new cloud tokens.
Revoke Entra sessions: Every active token and session stops working.

For an account with no Entra ID object, only the first step runs.

What happens when a step fails depends on the action's intent:

Containment, the usual intent for a quarantine: the steps that finished stay in place, and the action is escalated to a person. A partly contained account is safer than one re-enabled automatically.
Hygiene: the steps that finished are reversed, last first. If the Entra block fails, for example, the AD account is enabled again.

The receipt's Steps section lists each step and its result, including any step that was reversed.

Safety Rails

A fixed deny list applies to every action. No setting changes it, and it applies whatever the safety score or role.

It answers three different questions, and the answer decides what you can do about a refusal.

Never, by anyone

These have no safe manual form, so they stay blocked even for a person who confirms them.

Protected object	What's blocked
krbtgt (RID 502), and any account named krbtgt	Every change
The AD replication account	Password reset, which would break replication
The last remaining Global Administrator	Removing the role, once the count shows it's the last one
Some permission entries	Removing one that the directory needs for replication, that resets itself, that lives partly in the policy's files, or that would lock out the write account itself. See AD Permission Revocation.

Blocked for automation; a person can confirm

Automation is refused on these outright. A signed-in person can proceed after confirming the object by typing its name.

Protected object	What needs confirming
Built-in Administrator (RID 500), and any account named Administrator	Disable, enable, move to another organizational unit, password reset, blocking or allowing Entra sign-in, and adding a service principal name
Domain Controllers group (RID 516)	Removing a member from it, and removing it from another group
Built-in Administrators group (S-1-5-32-544, matched by SID)	Removing a member
Objects the directory marks critical (`isCriticalSystemObject`)	Every change
GraphnAI's own accounts: the bridge sync accounts, the remediation write accounts and Entra apps, and the app GraphnAI signs in with	Every change

See Confirming a Change to a Protected Object for the confirmation, including why an API key can never satisfy it.

The full deny list, with the reason for each entry, is on the Guardrails tab of Admin > AI Provider.

Couldn't be checked

The check didn't finish, so it's not known whether the object is protected. The action is held rather than refused, and it runs on a later try once the fault clears. It's never escalated as a permanent failure, because nothing about the object was established.

That covers a deny list that couldn't be read, a Global Administrator count that couldn't be established, a policy container that couldn't be found or didn't match, and a target that couldn't be resolved. In Select Fire, these show Couldn't check. When GraphnAI's own accounts aren't confirmed yet, the action shows On hold with "The platform's own accounts aren't confirmed yet. Run a sync, then test the remediation credentials."

How a refusal is returned

These checks run before anything is sent to the directory. A blocked action is refused with its reason, so you know whether nobody can run it, a person needs to confirm it, or the check couldn't run.

The deny list fails closed. When the target can't be resolved to check it, the action is held. An action never goes through on an unclear identity lookup.

[!IMPORTANT] The deny list and the confirmation are both enforced when the action runs, not in Graphne. A recommendation that names a protected object is still checked when it runs. Admins can choose any action, but can't skip the confirmation. Graphne never has the remediation credentials.

Configuring Remediation Credentials

Remediation credentials are separate from sync credentials. Sync reads with a read-only account. Changes need a separate account with write access. If the sync account is ever compromised, it still can't change the directory.

Set them up on Admin > Remediation Credentials. See Semi-Auto Execution for the steps.

AD remediation credentials

The AD write account needs:

LDAP bind access to the domain, with write access
Delegated rights on the target organizational units to change userAccountControl, servicePrincipalName, adminCount, msDS-AllowedToDelegateTo, gPLink, and group member
For password resets, the Reset Password right and write access to unicodePwd, over LDAPS (TLS)
For permission entry removals, the right to change permissions (WriteDacl) or ownership on the objects
For delegation changes, write access to the User-Account-Restrictions property set on the target objects. Clearing unconstrained delegation or protocol transition also needs the user right "Enable computer and user accounts to be trusted for delegation", granted through the Default Domain Controllers Policy. Scope the grant to the organizational units that hold delegation findings, never the domain root. See Required account rights.

Required role: Admin. Credentials are encrypted at rest, and they're masked when shown again.

Validating credentials

Select Validate on the page after you save credentials. It confirms the account can bind over LDAP before any action runs, and it lists each Entra ID permission. See Semi-Auto Execution for the results.

Entra ID write app registration

Entra ID actions need an app registration separate from the one used for sync. The write app needs admin consent for these Microsoft Graph application permissions:

Permission	Needed for
`User.ReadWrite.All`	Blocking and allowing sign-in, and revoking sessions
`RoleManagement.ReadWrite.Directory`	Removing directory role assignments
`AppRoleAssignment.ReadWrite.All`	Removing app role assignments
`DelegatedPermissionGrant.ReadWrite.All`	Removing OAuth permission grants

Set the Entra write credentials for each domain on Admin > Remediation Credentials, under Entra ID. See Setting up the Entra ID write app.

Before/After Audit Trail

Every action captures the relevant attributes before it runs:

Action	Captured attributes
`DISABLE_USER` / `ENABLE_USER`	`userAccountControl`, `enabled`
`SET_NOT_DELEGATED`, `CLEAR_NOT_DELEGATED`, and the smart card actions	`userAccountControl`
`REMOVE_SPN` / `ADD_SPN`	`servicePrincipalName`
`CLEAR_ADMIN_COUNT`	`adminCount`
`RESET_PASSWORD`	`pwdLastSet`
`MODIFY_CONSTRAINED_DELEGATION`	`msDS-AllowedToDelegateTo`
`MOVE_TO_OU`	`distinguishedName`
`REMOVE_GPO_LINK`	`gPLink`, read from the container
`ENTRA_BLOCK_SIGN_IN` / `ENTRA_UNBLOCK_SIGN_IN`	`accountEnabled`
`ENTRA_REVOKE_SESSIONS`	`signInSessionsValidFromDateTime`

Removing a group membership, a directory role, an app role, or an OAuth grant changes a relationship, not an attribute of the account. For those, the read-back after the change checks the relationship itself.

The before state is in the remediation history, which keeps entries for 2 years. Each entry records the action, the subject, the domain, the result, the times, any steps, and who authorized it.

Troubleshooting

Action denied on a protected account

What you can do depends on the account. See Safety Rails.

For krbtgt and the other "never, by anyone" entries, the refusal is final. No setting or confirmation unlocks it.

For the built-in Administrator, the Domain Controllers group, and the other confirmable entries, the refusal means the request was unattended. A signed-in person can proceed by confirming the object by name. When a script or API key sends a confirmation, the response says the session was unattended. It doesn't report a mismatched name, because the name may have been right and was never read.

Action held because the check couldn't run

GraphnAI couldn't establish whether the object is protected. Usually the target couldn't be resolved, the deny list couldn't be read, or a policy container wasn't found. The action is held, not refused. It runs on a later try once the fault clears, and it isn't escalated as a permanent failure.

Check that the identity has synced. The deny list fails closed, so an action never goes through on a target it can't resolve.

Remediation credentials not configured

The row says "No directory write account is set up for this domain. Add one under Remediation Credentials." or "This domain has no Entra write credentials. Add them in Remediation Credentials." Open Admin > Remediation Credentials, choose the domain, turn on Use these credentials for the directory, and save. See Configuring Remediation Credentials.

A quarantine didn't finish every step

Open the action's receipt on the History tab. Steps shows which step failed and which were kept or reversed. Common causes:

The Entra write app lacks a required permission. Check its API permissions in the Entra admin center, then select Validate.
The bridge connection dropped before the AD step finished.
Microsoft Graph limited the request rate. Requests are retried up to 3 times, with a wait between each.

Password reset fails

A password reset needs LDAPS (TLS). Check that Require TLS (LDAPS) is on in the domain's remediation credentials, and that the bridge host trusts the domain controller's LDAPS certificate.