A county asks how local administrator rights on a workstation differ from domain user rights when planning Active Directory attack paths. What distinction matters most?
Select an answer to reveal the explanation.
Short Explanation
Local admin is the keys to one house; domain rights are the neighborhood association powers. House keys help grab wallets left on the counter. Association powers move you through the directory — keep those layers straight when planning paths.
Full Explanation
Local administrator rights and domain user rights enable different stages of Active Directory attack paths. Local admin primarily aids host control and credential-theft classes (memory, local secrets, lateral admin reuse) on a county workstation, while domain rights and ACL/group edges enable directory privilege paths toward higher AD privilege. Planning civic AD assessments requires keeping that distinction sharp.
They are not interchangeable labels for the same Kerberos ticket. Domain user rights alone do not always allow remote dumping of every DC secret. Local admin is highly relevant on Windows AD paths—not a Linux-only concern—and Windows AD assessments routinely start from host privilege footholds.
Exam caveat: map “what this principal can do on hosts” separately from “what this principal can change in the directory.” CPTS path narratives should show how local footholds feed directory escalation without conflating the two.
Operational check: for representative civic accounts, record local admin presence versus domain group/ACL privileges, and build the attack-path story showing which capability unlocked the next hop. Write the county attack-path narrative so executives see host footholds and directory edges as linked stages, each with different containment controls.