A library Active Directory ACL lets a helpdesk-related group modify membership of an Administrators-tier group. What control question does this raise?
Select an answer to reveal the explanation.
Short Explanation
If you can rewrite the guest list for the VIP room, you do not need the VIP badge yet — you mint one. Control of privileged group membership is a classic escalation edge. Trace who can edit whom.
Full Explanation
Who can change privileged group membership is a critical control path. If a library Active Directory ACL lets a helpdesk-related group modify membership of an Administrators-tier group, helpdesk-equivalent principals can add themselves or others into high privilege—an escalation avenue with direct impact on systems that serve patrons and staff. Assessors should treat writable privileged-group ACLs as first-class path findings.
Group membership ACLs are not “email distribution list only” concerns when the target group is Administrators-tier. Write access on a group does not automatically mint Domain Admin tokens until membership is abused, but it enables that step—so calling it automatic token receipt overstates mechanism while understating the real control gap would be worse. Lack of interactive logon rights for editors does not make ACL write harmless if they can still change membership through directory protocols.
Exam caveat: BloodHound-class path analysis centers on who can control whom; ACL write on privileged groups is classic escalation terrain. Distinguish capability from completed abuse in report language.
Operational check: enumerate ACLs on Administrators-tier and equivalent groups, remove unnecessary helpdesk write rights, monitor membership changes, and re-validate that civic helpdesk workflows use approved PAM/JIT processes instead of standing ACL control.