What is Domain Admin?

Domain Admins is a highly privileged group in an Active Directory domain. By default, its members can administer the domain’s controllers and joined computers. In assessment reports, “Domain Admin” also commonly describes equivalent administrative control, even when an attacker has not joined that group.

That makes Domain Admin a useful objective when testing whether a limited foothold can become broad control of a Windows domain.

What that access permits

Domain administrators can manage directory accounts, group membership and policy. That access can expose credentials and create routes to other computers. The exact reach depends on the environment’s permissions and controls.

Domain Admins and Enterprise Admins are different groups. A forest can contain several domains, and Microsoft treats the forest as the Active Directory security boundary. A route from one domain to another still needs to be established in the test; a group name alone does not describe every system reached. See Microsoft’s Active Directory security group reference.

How a limited account can lead there

A route might begin with an exposed password, excessive delegated rights or administrative credentials left on a reachable server. Active Directory penetration testing examines how those conditions combine into access.

Domain Admin is one possible objective. Reading sensitive records or taking over a backup server can be serious even without it. Choose the objective that matches the system you need to protect.

Testing it with AutoAttack

Set Domain Admin as the objective and choose a starting point inside your network. You can supply an assumed-breach credential or start without one. The report shows the access the campaign gained and the evidence behind the route.

The AD takeover walkthrough explains the approach. The black-box lab write-up documents a completed run.