Exactly. Domain Admin is a sledgehammer. Make some more granular groups, and add people to the groups that get to do what they need.

I have no problem with doing it however, so long as I can fully audit everything. Our IT team is very lazy and won't reseach a solution, nor will they give us Domain Admin access to do it ourselves.

Figure 13 The number of domain admin groups will vary depending on how many domains you have or have scanned with SharpHound. Now let's run a built-in query to find the shortest path to domain admin.

Yaron Kassner, CTO and co-founder of Silverfort, discusses why using all-seeing privileged accounts for monitoring is bad practice. In almost every network, there is a highly privileged service ...

Microsoft warned customers today to patch two Active Directory domain service privilege escalation security flaws that, when combined, allow attackers to easily takeover Windows domains.

Although Microsoft has a permanent fix on the way, it's possible that you're exposing domain admin account credentials in cleartext. Here's how to check for and solve that problem.