How Tier Zero Objects are Identified
Following are the criteria that the Security Guardian Tier Zero provider uses to identify Tier Zero objects in Active Directory.
-
Domains: The Domain object is identified as Tier Zero because it is a domain partition in the Active Directory forest which supports replication and administrative functions.
-
Groups: May be identified as Tier Zero if they are a Default AD Security Group which has access to Tier Zero objects in the domain, or if they are a member of another Tier Zero group (either directly or indirectly).
The default AD Security Groups considered Tier Zero are:
|
√ Account Operators
√ Administrators
√ Backup Operators
√ Cert Publishers
√ Cloneable Domain Controllers
√ Cryptographic Operators
√ Distributed COM Users
√ DnsUpdateProxy
√ DnsAdmins
√ Domain Admins
√ Domain Controllers
√ Enterprise Key Admin
√ Enterprise Admins |
√ Enterprise Read-Only Domain Controllers
√ Group Policy Creators Owners
√ Hyper-V Administrators
√ Incoming Forest Trust Builders
√ Key Admins
√ Network Configuration Operators
√ Performance Log Users
√ Print Operators
√ Read-Only Domain Controllers
√ Remote Management Users
√ Schema Admins
√ Server Operators
√ Storage Replica Administrators |
-
Users: May be identified as Tier Zero if they are a member of a Tier Zero group (either directly or indirectly).
-
Computers: May be identified as Tier Zero if they are a Domain Controller, Read-Only Domain Controller, or they are a member of a Tier Zero group (either directly or indirectly).
-
Group Policies: May be identified as a Tier Zero if they are linked to the Domain, linked to an AD Site, or linked to an organizational unit (OU) that contains a Domain Controller or Read-Only Domain Controller.
Tier Zero Objects List
The Tier Zero Objects list displays all of the Tier Zero objects that have been collected by the Tier Zero provider (Security Guardian or BloodHound Enterprise) as well as any that have been manually-added by users.
|
|
NOTE: If BloodHound Enterprise is configured and you see the message No New Tier Zero Objects, check the BloodHound Enterprise configuration within On Demand Audit. Review the configuration connection message details to determine whether the connection to SpecterOps has been successful. Review the Last Configuration Received, Next Configuration Synchronization, and the status of the configuration. |
To access the Tier Zero Objects list:
From the On Demand left navigation menu, choose Security | Tier Zero Objects. The following information is listed for each Tier Zero object:
-
Display Name
-
Principal Name
-
Distinguished Name
-
Object Type
-
Date Added
|
|
NOTE: This field displays the signed-in user's local date and time. |
|
|
NOTE: If you click the Filter button, you can filter displayed results by one or more of the following criteria:
- Principal Name
- Distinguished Name
- Object Type
- Added By
- Certification Status
- Protection Status
|
From the Tier Zero Objects list, you can:
Viewing Tier Zero Object Details
To view a Tier Zero object's details:
From the Dashboard Uncertified Tier Zero Objects tile or the Tier Zero Objects list, click the object's Principal Name.
The following information displays for the selected Tier Zero object:
- for a User object, local admin privileges
- for a Group object, any other groups it is a member of
- for a Group Policy object, objects affected by the Group Policy
NOTE: BloodHound Enterprise classifies domains affected by a Group Policy as OUs.
- objects that the selected object can control
- objects that have control over the selected objects.
|
|
NOTE: BloodHound Enterprise returns a maximum of 1000 related objects for each Tier Zero category. |
Adding Tier Zero Objects Manually
You can add Tier Zero objects manually for AD objects that were not identified as Tier Zero by the Tier Zero provider but are considered critical assets in your organization.
-
Use one of the following options:
-
For each Tier Zero object you want to add:
-
Enter the object's Principal Name, or type at least two characters then select the object from the drop-down. (Note that a message will display if the object is already Tier Zero.)
The object will be added to the Principal Name list.
-
In the Principal Name list, select object(s) you want to add.
-
Click Save.
