Detecting when new Windows Domain Administrator accounts are created is important to audit and ensure that they have been created for business purposes. Often the addition of these accounts results in significant risk and exposure to an organization and access should be limited as much as possible.
Get your free account with Blumira and secure your Microsoft 365 environment in minutes. No credit card required.
Prerequisites: Be sure to configure the NxLog integrations for Windows on your Domain Controller before testing.
Step 1: Login to your Domain Controller logging to Blumira
Step 2: Go to “Users and Computers” in Active Directory
Step 3: Create a new user account
Step 4: Assign them to group “Domain Admins”
Step 5: Once created and applied, a finding will generate in Blumira in the Responder Dashboard
Step 6: Be sure to delete or disable the new domain admin user after testing is completed.