Schema Admins and Enterprise Admins: groups that should stay empty
The Schema Admins and Enterprise Admins groups grant power over the whole forest, far beyond a single domain. Yet they are only needed for rare operations. Keeping them permanently populated multiplies the accounts whose compromise is enough to lose the entire forest.
Two forest-wide groups
Both groups only exist in the forest root domain. Enterprise Admins are members of the Administrators group in every domain of the forest and can manage forest configuration (sites, trusts, enterprise certification authorities). Schema Admins can modify the schema, the very definition of the directory's objects and attributes. A schema change is irreversible in most cases and replicates to every domain controller in the forest.
When the forest is created, the built-in Administrator account of the root domain is a member of both groups. This is often where drift begins: domain admins get added later "just in case".
When are they really needed?
| Group | Typical operations | Frequency |
|---|---|---|
| Schema Admins | schema extensions (Exchange, Windows LAPS, third-party applications), forest upgrades | a few times a year, or less |
| Enterprise Admins | adding or removing a domain, creating trusts, installing an enterprise certification authority, some configuration tasks | rare |
Day-to-day domain administration is done with the domain's Tier 0 accounts, not with these groups. In a single-domain forest, Domain Admins is enough for the vast majority of tasks.
Temporary, traceable membership
The principle is simple: these groups are empty under normal conditions. For a planned operation, a named admin account is added, the operation is performed from a Tier 0 admin workstation, and the account is removed. Both the addition and the removal are recorded in the change ticket.
To avoid oversights, Active Directory offers the Privileged Access Management optional feature, available from the Windows Server 2016 forest functional level. It lets you add a member with a time-to-live: when it expires, the membership disappears automatically, and issued Kerberos tickets are limited to that lifetime. Enabling it cannot be undone, so assess it against Microsoft's documentation first. Failing that, a scheduled task that empties the groups and alerts on any unexpected member provides a safety net.
Hardening the built-in Administrator account
The built-in Administrator account (RID 500) in each domain deserves special treatment, because it does not lock out by default and its identifier is well known. Renaming it provides no real protection. Useful measures include:
- a long random password stored in a vault with an emergency recovery procedure;
- the "Account is sensitive and cannot be delegated" option;
- Group Policy settings that deny it logon on member servers and workstations: network access, Remote Desktop Services, batch job and service logon;
- removing this account from Schema Admins and Enterprise Admins except for one-off needs;
- an alert on any use, since it should only serve in emergencies.
Monitoring changes
Any change to these groups should trigger an immediate alert. Since Schema Admins and Enterprise Admins are universal groups, additions and removals generate events 4756 and 4757 on domain controllers, provided security group management auditing is enabled. It is also wise to audit changes to the schema partition (event 5136 with directory service changes auditing) to catch unplanned extensions.
Check indirect paths. An empty group is not protected if someone can add members to it. Review the ACLs on these groups, on the AdminSDHolder object and on the schema partition: write access to any of them is almost as good as membership.
What an audit checks
- the number of members of Schema Admins and Enterprise Admins, including through nested groups;
- the last logon and password change dates of the built-in Administrator account;
- the logon restrictions applied to that account;
- auditing and alerting on changes to these groups and to the schema;
- who can modify these groups and AdminSDHolder.