IN_GROUP

Summary

FSProtect ACL Alias	IN_GROUP
Affected Object Types	Users, Groups, Computers
Exploitation Certainty	Certain

Description

IN_GROUP permission in an Active Directory environment grants an account membership in a specific domain group, enabling the user—or an attacker who compromises that account—to perform every action allowed by the group’s privileges. This may include managing shared resources, configuring domain-wide settings, or controlling important services. Thus, support teams or application owners gain the exact privileges needed at the domain level without holding full administrative rights (e.g., Domain Admin), ensuring a more controlled and secure delegation model.

However, if misconfigured or inadequately managed, IN_GROUP can lead to critical security risks. A malicious actor who obtains unauthorized membership in a high-privilege domain group could access or modify sensitive data, disrupt key services, and potentially establish persistent administrator-level control over the domain. Consequently, regularly auditing these memberships and granting them only to necessary accounts are essential steps to maintain a secure and resilient Active Directory infrastructure.

Identification

PowerShell

Active Directory Module

Using the ActiveDirectory PowerShell module, you can enumerate group membership information for all groups or a specific group in the domain.

Function: Find-IN_GROUP

function Find-IN_GROUP {
    [CmdletBinding()]
    param ( [string]$GroupDN = $null, [string]$OutputPath = "ADGroupsMembers.csv")
    Import-Module ActiveDirectory -ErrorAction Stop
    $results = @()
    try {
        if ($GroupDN) {
            Write-Host "Scanning specific group: $GroupDN"
            $memberNames = (Get-ADGroupMember -Identity $GroupDN -ErrorAction SilentlyContinue |
                            Select-Object -ExpandProperty Name) -join ';'
            $results += [PSCustomObject]@{
                GroupName = $GroupDN
                Members   = $memberNames
            }
        }
        else {
            Write-Host "Scanning all groups in the domain..."
            $groups = Get-ADGroup -Filter * -ErrorAction Stop
            foreach ($group in $groups) {
                $memberNames = (Get-ADGroupMember -Identity $group.DistinguishedName -ErrorAction SilentlyContinue |
                                Select-Object -ExpandProperty Name) -join ';'
                $results += [PSCustomObject]@{
                    GroupName = $group.Name
                    Members   = $memberNames
                }
            }
        }
    }
    catch {
        Write-Error "Failed to enumerate groups: $($_.Exception.Message)"
        return
    }
    if ($results.Count -gt 0) {
        Write-Host "Found $($results.Count) group record(s)."
        try {
            $results | Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8 -ErrorAction Stop
            Write-Output "Results exported successfully to '$OutputPath'"
        }
        catch { Write-Error "Failed to export results to CSV file '$OutputPath': $($_.Exception.Message)" }
    }
    else { Write-Output "No groups or members found."}
}

Usage Examples:

1. Scan all groups in the domain

Find-IN_GROUP

2. Scan a specific group by Distinguished Name

Find-IN_GROUP -GroupDN "CN=Administrators,CN=Builtin,DC=forestall,DC=labs"

3. Save results to a custom location

Find-IN_GROUP -OutputPath "C:\Temp\GroupMembers.csv"

Active Directory Users and Computers (GUI)

1. Open Active Directory Users and Computers.

2. Double-click on the Group.

3. In the Properties window, navigate to the Members tab.

4. Review the list of Users and Groups.

5. Click OK to close.

Exploitation

This permission can be exploitable on Windows systems , while on Linux systems, tools such as impacket tools can be effectively used for exploitation.

The impact of IN_GROUP depends on which group the attacker is added to:

Windows

• Account Operators — Password Reset / Account Takeover Members can reset passwords or re-enable most non-admin accounts, enabling identity takeover, mailbox/file access, and pivots via inherited permissions. AdminSDHolder-protected accounts are typically excluded. Reference: ForceChangePassword

• Backup Operators — Extract Directory Secrets via Backup Privileges Members can back up system state or NTDS.dit to recover credential material offline. Note: DCSync is not granted by this membership—it requires explicit replication rights (GetChanges*/GetChangesAll) on the domain. Reference: SeBackupPrivilege

• Server Operators — Powerful Local Control on DCs (member servers only if delegated) On domain controllers, members can manage services, files, and shares—often enough to reach SYSTEM, execute arbitrary code, and harvest credentials. On member servers, similar power exists only where explicitly granted (e.g., via GPO or local group mapping). Reference: ADMIN_TO

• Print Operators — Logon on DCs / Local Escalation Vector Members can interactively sign in to DCs and administer the print subsystem. Local DC access increases opportunities to exploit machine-local issues (e.g., driver loading paths) or harvest privileged tokens. Reference: HAS_SESSION

• Domain Admins — Unfettered Domain Control Full control of domain policy, users, computers, and DCs. Adversaries can alter ACLs, push GPO-based persistence, and disable defenses—effectively owning domain-joined assets. Reference: GenericAll

• Enterprise Admins — Forest-Wide Authority Superset of Domain Admin across all domains in the forest: can push cross-domain changes, create new domains, and modify enterprise-wide configuration for durable, stealthy persistence. Reference: GenericAll

• Schema Admins — Directory Schema Control Can modify classes/attributes that define directory behavior. Abuse can add backdoor attributes or expand rights surfaces that replicate forest-wide and persist beyond typical remediation. Reference: GenericAll

• Group Policy Creator Owners — Malicious GPO Creation Members can create new GPOs carrying attacker-controlled scripts, tasks, or registry changes. If another principal links those GPOs, they become a powerful, repeatable execution/persistence mechanism. Reference: GPOWrite

• BUILTIN\Administrators — Local Admin on DCs/Servers Grants full local control wherever the group applies (including DCs). From that foothold, an attacker can run as SYSTEM, harvest secrets, and reconfigure security tooling—often leading to domain compromise. Reference: ADMIN_TO

• Remote Desktop Users — Interactive Access for Pivoting Members can obtain RDP sessions to run tools, collect credentials, and move laterally—provided RDP is enabled and policy allows logon. Interactive sessions also inherit user-context trusts (mapped drives, saved creds, delegated tokens). Reference: CAN_RDP

• Remote Management Users — PowerShell Remoting Execution Enables remote command execution over WinRM/PowerShell Remoting where the service/policy is enabled. Useful for “living off the land” lateral movement that blends with admin activity. Reference: CAN_EXEC_PWSH

• Distributed COM Users — DCOM-Based Remote Execution Grants remote activation/launch rights that can translate to code execution on COM servers whose security descriptors permit it. Useful where RDP/WinRM are limited or closely monitored. Reference: CAN_EXEC_DCOM

Mitigation

You can mitigate IN_GROUP with following steps:

1. Open Active Directory Users and Computers.

2. Double-click on the Group.

3. In the Properties window, navigate to the Members section.

4. In the Members list, locate and remove Users and Groups.

5. Click OK to close the dialogs.

Active Directory Users and Computers

Detection

Adding new Access Control Entries on the Active Directory objects changes the ntSecurityDescriptor attribute of the objects themselves. These changes can be detected with the 5136 and 4662 Event ID's to identify dangerous modifications.

Event ID	Description	Fields/Attributes	References
5136	A directory service object was modified.	ntSecurityDescriptor	https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
4662	An operation was performed on an object.	AccessList, AccessMask	https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662

References

• Understand Security Groups (Windows Server) - Microsoft Learn

• Active Directory Groups - SolarWinds

• Privileged Accounts and Token Privileges - iRed Team