Detections
Analytics

AdminCount Attribute Set on Standard Users

medium

Language:

Description

The adminCount attribute creates exceptions in global policies.

Solution

Reset the adminCount property for accounts who no longer have administrative roles.

See Also

Admin-Count attribute

Indicator Details

Name: AdminCount Attribute Set on Standard Users

Codename: C-ADMINCOUNT-ACCOUNT-PROPS

Severity: Medium

MITRE ATT&CK Information:

Tactics: TA0004

Techniques: T1078