SysFlint AD
Privileged Group Auditing (Domain Admins and Friends)
The membership of Domain Admins is the shortest possible summary of who can end your organization on a bad day. It should be small, it should be deliberate, and every member should be explainable. In practice it grows: a migration added a service account, someone was elevated for a project in 2021, and a nested group quietly brings in eleven people nobody counted.
How this is normally done
Recursive group enumeration gets you the list, and this is the version worth running today if you have not looked recently:
$privileged = 'Domain Admins', 'Enterprise Admins', 'Schema Admins',
'Administrators', 'Account Operators', 'Backup Operators'
foreach ($group in $privileged) {
Get-ADGroupMember -Identity $group -Recursive |
Get-ADUser -Properties Enabled, LastLogonDate, PasswordLastSet |
Select-Object @{ N = 'Group'; E = { $group } },
Name, SamAccountName, Enabled, LastLogonDate, PasswordLastSet
}Where it stops being enough
- It tells you who is a member now, not who was added last month or by whom.
- adminCount artefacts — accounts that were once privileged and still carry the flag — need separate hunting.
- Cross-domain and foreign security principals in a forest need extra handling.
- Nothing alerts you when the group changes; you find out next time you remember to run it.
What SysFlint AD does instead
Privileged membership treated as something to watch continuously, not to reconstruct on demand.
- Full recursive membership of every built-in privileged group, with the nesting path shown.
- Flags the combinations that matter: disabled accounts still in Domain Admins, stale privileged accounts, privileged accounts with non-expiring passwords.
- Surfaces adminCount leftovers — accounts that carry the privileged flag after the privilege was removed.
- Membership diffed between runs, so additions and removals are visible with dates.
- Consolidated across every domain in the forest, including foreign security principals.
What's in the report
- Every member of Domain Admins, Enterprise Admins, Schema Admins, Administrators, and the operator groups
- Direct vs. nested membership, with the group path that grants it
- Account state for each member: enabled, disabled, stale, password age
- Accounts with adminCount set but no current privileged membership
- What changed since the previous run
Frequently asked questions
- Can I audit my own custom privileged groups?
- Yes. The built-in tier-0 groups are covered by default, and you can add any group you treat as privileged — your own admin roles, application owner groups, or delegated-OU groups.
- Does it show nested group membership?
- Yes, recursively, and it shows the path. "Effective member via IT-Ops → Server-Admins → Domain Admins" is a lot more actionable than a flat list of names.
- Can it tell me when someone was added to Domain Admins?
- It diffs membership between runs and reports what changed, which gives you a dated record as long as the report is scheduled. It is a reporting tool, not a real-time event monitor tapping the security log.
Related features
Related use cases
Get SysFlint AD
Free, forever. No license keys, no per-user pricing, no seat counts, no trial timer.