Topic starter
08/07/2026 7:04 pm
TL;DR: Active Directory still concentrates the most powerful privileged access in many organisations, and delegated or custom permissions can be as impactful as Domain Admin membership, according to Paramount Defenses. The real governance problem is effective permissions, not just group membership, because one unidentified account can expose the domain.
Editorial analysis by NHI Mgmt Group, based on content published by Paramount Defenses: “Privileged Access”.
By the numbers:
- 85% of all organizations worldwide place the most powerful privileged access in Active Directory.
Key questions
Q: What breaks when Active Directory reviews stop at Domain Admin membership?
A: Teams miss delegated and custom permissions that can change passwords, group membership, ACLs, trusts, and policy objects.
Q: Why do delegated Active Directory rights create more risk than they appear to on paper?
A: Because small-looking rights can translate into broad control once inheritance and object relationships are resolved.
Q: How do security teams identify privileged access hidden in ACLs?
A: Start by tracing who can perform domain-admin-equivalent tasks on high-value objects such as users, groups, computers, OUs, policies, and trusts.
Practitioner guidance
- Map effective permissions on critical AD objects Inventory who can modify domain root objects, domain controller objects, high-value OUs, security groups, and privileged passwords, then compare those rights with default admin memberships.
- Classify domain-admin-equivalent tasks as privileged Treat actions such as changing group membership, resetting privileged passwords, linking GPOs at the domain root, and altering trust relationships as privileged access requiring review.
- Review delegated administrators separately from admins Create a distinct review path for delegated admins who can manage user accounts, groups, computers, or OUs, because their scope can equal or exceed named admin roles.
Bottom line: Active Directory privileged access is broader than default admin group membership, because delegated permissions can be equally powerful.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:28 pm
Effective permissions are the real privileged boundary in Active Directory: group membership is only a shortcut view. The article is right to centre effective permissions because ACL-driven delegation can grant equal or greater control than default admin roles. That means privileged access governance fails when it treats labels as authoritative and ignores what the account can actually do.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do when delegated administrators can reset privileged passwords?
A: They should treat those accounts as privileged and include them in PAM, certification, and monitoring scope. A delegated admin that can reset passwords, change memberships, or modify ACLs can control access to everything the target account can reach. That access must be governed as a high-risk privilege, not an operational convenience.
👉 Read our full editorial: Active Directory privileged access is still the keys to the kingdom