How to Find Every Domain Admin Account in Active Directory Right Now

An account achieves Domain Admin equivalent access through four paths:

1. Direct membership in the Domain Admins group: the obvious one
2. Membership in a group nested inside Domain Admins: a group called 'IT-Leads' added to Domain Admins gives every member of 'IT-Leads' full DA rights, but they do not appear in the Domain Admins group directly
3. Membership in equivalent privileged groups: Administrators, Schema Admins, Enterprise Admins, Group Policy Creator Owners, and Account Operators all grant domain-wide privileges equivalent to or exceeding Domain Admin for specific attack paths
4. Unconstrained Kerberos delegation: accounts or computers configured for unconstrained Kerberos delegation can be used to obtain Domain Admin TGT tickets when any privileged user authenticates to them

Post-incident investigations consistently find compromised accounts that were not in the Domain Admins group but had DA-equivalent access through one of the other three paths. Attackers who perform AD reconnaissance using tools like BloodHound identify all four paths: your audit should too.

Run these from a workstation with the Active Directory PowerShell module installed (available on any domain-joined machine with RSAT tools).

Command 1: Direct Domain Admins group members (including nested)

Get-ADGroupMember -Identity "Domain Admins" -Recursive | Select-Object Name, SamAccountName, ObjectClass | Sort-Object Name

The -Recursive flag resolves nested group membership. Without it, you see groups, not the users inside them.

Command 2: All equivalent privileged group members

$privGroups = @("Administrators", "Schema Admins", "Enterprise Admins", "Group Policy Creator Owners", "Account Operators", "Backup Operators", "Print Operators")
foreach ($group in $privGroups) {
    Write-Host "=== $group ==="
    Get-ADGroupMember -Identity $group -Recursive 2>$null | Select-Object Name, SamAccountName, ObjectClass
}

This surfaces members of all groups that grant domain-wide or privileged access. Schema Admins membership can modify the AD schema: equal to or greater than DA for certain attacks. Backup Operators can read any file on any domain member server.

Command 3: Accounts protected by AdminSDHolder

Get-ADUser -LDAPFilter "(admincount=1)" -Properties admincount, LastLogonDate, PasswordLastSet | Select-Object Name, SamAccountName, Enabled, LastLogonDate, PasswordLastSet | Sort-Object LastLogonDate

AdminSDHolder sets admincount=1 on accounts that are or were members of protected groups. Accounts that were removed from privileged groups years ago may still retain the AdminSDHolder ACL protection: and the elevated permissions it confers: if the SDProp process was not run to clean them up.

Command 4: Accounts with unconstrained Kerberos delegation

Get-ADUser -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation | Select-Object Name, SamAccountName
Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation | Select-Object Name, DNSHostName

Any account or computer with unconstrained delegation is a target for the printer bug / SpoolSample technique: when a Domain Controller authenticates to a machine with unconstrained delegation, the DC's TGT can be captured and used to perform DCSync, giving an attacker Domain Admin credentials.

Command 5: Service accounts with privileged access (often overlooked)

Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName, MemberOf, admincount | Where-Object {$_.admincount -eq 1 -or $_.MemberOf -match "Domain Admins|Administrators"} | Select-Object Name, SamAccountName, ServicePrincipalName

Service accounts with SPNs registered (which enables Kerberoasting) that also have privileged group membership are the highest-risk finding in most AD environments. An attacker who obtains a Kerberoastable hash for a service account with DA rights has a path to Domain Admin without requiring interactive login.

Export all five command outputs to CSV and combine them:

# Example for Command 1
Get-ADGroupMember -Identity "Domain Admins" -Recursive | Select-Object Name, SamAccountName, ObjectClass | Export-Csv -Path C:\ADaudit\domain_admins.csv -NoTypeInformation

For each account in the combined output, ask four questions:

1. Is this account still active? Disabled accounts in privileged groups cannot be used directly but their group memberships are preserved: they can be re-enabled by anyone with sufficient AD rights. Remove disabled accounts from all privileged groups.

2. Does this account legitimately require Domain Admin access? Most operations attributed to DA accounts do not actually require DA. Patch management can use local admin. Backup agents should use a dedicated low-privilege account. AD read queries require no privileges. The default answer should be 'no': require the account owner to justify it.

3. When did this account last log in? A DA account that has not been used in 180 days is likely stale. Stale DA accounts are prime targets for attackers because they often have weak or unchanged passwords and their logon activity does not generate noise that would indicate compromise.

4. Does this service account have a SPN and privileged membership? That combination needs to be fixed immediately: either remove the DA membership (preferred) or use a managed service account (gMSA) with a 120-character randomly generated password that rotates automatically.

The five commands above find direct and one-level-nested privilege paths. BloodHound (open source, from SpecterOps) finds every attack path to Domain Admin in your environment: including multi-hop privilege escalation chains that PowerShell commands do not surface.

BloodHound ingests AD data via the SharpHound collector and builds a graph database of all relationships between accounts, groups, computers, and permissions. A query like 'find all shortest paths to Domain Admin' surfaces chains like:

• User A is a member of Group B
• Group B has GenericAll rights on Group C
• Group C is a member of Domain Admins

User A can reach Domain Admin through three hops that your five-command audit would not catch because User A is not in any privileged group.

BloodHound is the tool attackers use for this reconnaissance. Using it yourself gives you the same attack path visibility before the attacker does. Run BloodHound in read-only mode against a non-production AD snapshot if you need to minimize risk during the initial audit.