admincount Active Directory

The article will document and describe the admincount attribute in Active Directory. The primary purpose being that you may encounter an account in your Active Directory that has elevated privileges. The first step in determining if this is true is to look to see if admincount = 1. If so, there is a permission on the account determining the admincount value to be equal to 1. Or, at some point in the past the account had an elevated privilege and the admincount was never reset.

If the admincount attribute is set to 0 or does not exist, then the account does not have elevated privileges.

Privileged Group Membership

One common cause for the admincount attribute being set to 1 is if the account in a member of a privileged group. A list of privileged groups can be found here: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b–privileged-accounts-and-groups-in-active-directory

After removing the account from the privileged group, reset the admin count of the user. For instructions on how to remove users from groups see this article.

Powershell – reset admincount

To reset or clear the admin count, run this PowerShell command.

Set-ADUser -Identity <samAccountName> -Remove @{adminCount=1}
Get-ADUser -Identity <samAccountName> -Properties adminCount | Select adminCount

Every couple of hours a behind the scenes process will run and reset adminCount to 1 if privileged access is found on the account. If after some time you see the attribute set back to 1 you know you have more investigation to do. Double check the account’s group membership for additional groups that have elevated access.

Disable Inheritance

If admincount continues to be set to 1 make sure the account has inheritance disabled. It may have had elevated privileges at some point in the past that need to be reset with inheritance.

Conclusion – admincount Active Directory

This article has demonstrated how to maintain the admincount attribute in Active Directory. Let us know in the comments if you have any questions.