Child-domain admin access can expose replication rights and krbtgt material, which lets an attacker mint tickets that survive normal logon controls. If the forest root also trusts injected SID history, the attacker can cross domains and reach the root domain controller. The risk is the chain, not any single step.
Why forest compromise can start with a child domain
A child domain is not a safe boundary if the attacker can turn child-domain control into trust-path abuse. The meaningful question is not whether the first account was in the child domain, but whether that access exposed replication capabilities, privileged directory material, or trust relationships that let the attacker operate as the forest, not just as the child.
Once an attacker reaches the right directory privileges, they can target replication-seeded secrets such as krbtgt material, forge tickets, and keep access even after password resets and ordinary logon hardening. In a forest with permissive trust handling, the child becomes a launch point into higher-trust domains rather than a contained compromise.
That is why child-domain admin access is often treated as a tier-zero problem. The attacker does not need to own every domain to win; they need one control path that crosses the boundary between delegated administration and forest-wide authority.
How replication rights and forged tickets change the blast radius
Replication rights are dangerous because they expose the same secret material that domain controllers use to validate Kerberos tickets. If an attacker can obtain krbtgt-related material, they can mint tickets that look legitimate to directory services and continue using them until the relevant keys are rotated correctly. Normal endpoint logoff, password change, or account disable actions do not reliably stop that abuse.
This is where the compromise becomes structural rather than local. A child domain may have its own administrators, but if those administrators can reach directory replication paths or extract secret material from the domain, the attacker can impersonate trusted principals, move laterally, and pivot into the parent or root domain.
In practice, the blast radius grows because Kerberos trust is based on accepted claims, not just the immediate origin of the session. When forged tickets and delegation paths exist together, the attacker can preserve access across reauthentication events and use that access to continue harvesting privileges.
Why SID history and forest trust make the root domain reachable
SID history becomes dangerous when the forest root or parent trusts injected historical SIDs from a compromised child. That trust can let an attacker present an identity that appears to hold privileges in the root domain, even when the originating account was created lower in the hierarchy. The issue is not merely privilege escalation inside one domain, but trust translation across domains.
The root domain controller is the prize because it anchors forest-wide administration, policy, and often the most sensitive directory and security objects. If the attacker can cross into that trust plane, the compromise stops being a child-domain incident and becomes a forest-level control problem.
That is also why forest design matters. Delegation, SID filtering, tiering, and trust boundary enforcement determine whether a child-domain compromise stays local or becomes a bridge to the root. The architecture either constrains the attacker to the child or gives them a path to reuse the child compromise as forest authority.
Risk and Threat Considerations
Child-domain admin access is high impact because it can combine directory control, secret exposure, and trust abuse into a single attack path. The main risk is not the initial admin compromise, but the attacker’s ability to convert that foothold into durable, cross-domain access that survives routine remediation.
Failure mechanism: A compromised child-domain admin uses replication exposure or delegated directory control to obtain krbtgt material, then forges tickets or abuses SID history and trust relationships to reach higher-trust domains, including the forest root.
Impact: The attacker can move from a local domain compromise to forest-wide persistence, disable meaningful containment, and force full-directory recovery actions instead of simple account reset or host cleanup.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack surface, NIST SP 800-53 Rev 5 sets the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1484.001 — Domain Policy Modification | Child-domain abuse can alter trust and directory policy to extend access across the forest. |
| Recommendation — Monitor and restrict directory policy changes that can expand trust and forest-wide access. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The question centers on excessive privilege turning a child-domain admin into forest-wide access. |
| IA-5 — Authenticator Management | Forged tickets and krbtgt material make credential lifecycle central to the compromise path. | |
| Recommendation — Limit domain admin scope to the minimum privileges needed for each domain. Rotate and protect Kerberos secrets on a controlled lifecycle after suspected compromise. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Forest-wide compromise emerges from broken access boundaries and trust enforcement. |
| A.8.2 — Privileged access rights | The issue depends on privileged directory rights being able to reach higher-trust assets. | |
| Recommendation — Enforce access boundaries that prevent child-domain admin from crossing forest trust lines. Review and tightly constrain privileged rights that can affect root-trust assets. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The compromise path is privilege expansion from one admin context into broader forest access. |
| Recommendation — Remove excess directory privileges that let one identity control multiple trust boundaries. | ||
Practitioner Guidance
What to prioritise: Treat child-domain administrative paths as tier-zero exposure whenever they can influence directory replication, trust settings, or root-reachable privileges. If those paths exist, the control objective is to prevent child-domain admin from becoming a forest-adjacent identity.
What to verify: Confirm who can request replication-related rights, who can influence SID history, and whether SID filtering and trust boundaries are actually enforced the way the design assumes. Also verify that krbtgt rotation procedures exist for both the child and any impacted upstream domains.
What good looks like: A child-domain compromise can be contained to that domain without granting a path to mint durable tickets or inherit root-relevant authority. If that containment is not demonstrably true, the forest should be treated as exposed.
Practitioner takeaway: The real security question is whether child-domain administration is isolated from the mechanisms that define forest trust. If it is not, one compromised domain can become a directory-wide compromise.