skills.rest
Acczdy
AcczdyCOMMUNITY
Explore all skills by this author →
GitHub

performing-privileged-account-discovery

Enumerate privileged groups and service accounts via LDAP queries into JSON reports.

2|Updated Apr 14, 2026
Search Tags:#discovery#auditing#iam#active-directory#service-accounts#ldap#privileged-accounts
One-click install
npx skills add https://github.com/Acczdy/MoZiSec --skill performing-privileged-account-discovery
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-privileged-account-discovery
Source: https://github.com/Acczdy/MoZiSec/tree/main/iam/.claude/skills/performing-privileged-account-discovery
Command: npx skills add https://github.com/Acczdy/MoZiSec --skill performing-privileged-account-discovery

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ldap3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Discover and inventory privileged accounts across enterprise directories to identify excessive privileges, shadow admin paths, and unmanaged service accounts that increase risk and hinder incident response.

Core Features & Use Cases

  • Privileged group enumeration: Detect memberships of Domain Admins, Enterprise Admins, Schema Admins, and other high-privilege groups.
  • Service account discovery: Find accounts with servicePrincipalName and report SPNs for Kerberos/service mapping.
  • Shadow admin detection: Resolve nested memberships via LDAP_MATCHING_RULE_IN_CHAIN and flag adminCount users for orphaned or delegated privileges.
  • Reporting & integration: Output structured JSON reports for PAM onboarding, audit evidence, and SIEM ingestion.
  • Use Case: Security teams and auditors can run the agent against a lab AD to produce a compliance-ready inventory of privileged identities and service accounts.

Quick Start

Run the LDAP discovery agent with valid bind credentials and an LDAP server URL to generate a JSON report of privileged accounts.

Frequently Asked Questions about performing-privileged-account-discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover privileged accounts in Active Directory using LDAP?▼

To discover privileged accounts in Active Directory, you query the directory using LDAP to enumerate high-privilege groups like Domain Admins, resolve nested memberships, and flag adminCount attributes for a complete security inventory.

What is a shadow admin and how does nested group membership detection work?▼

A shadow admin is a user with indirect, delegated privileges. Detection works by resolving nested group memberships using LDAP_MATCHING_RULE_IN_CHAIN queries to uncover hidden administrative paths and orphaned privileges in the directory.

Can I find service accounts with servicePrincipalName attributes during an AD audit?▼

Yes, you can find service accounts during an AD audit by performing servicePrincipalName enumeration via LDAP queries. This identifies Kerberos service mappings and reports unmanaged service accounts that increase security risk.

What's the best way to generate a compliance-ready inventory of domain admins?▼

The best way to generate a compliance-ready inventory is to run an LDAP discovery agent with valid bind credentials against your AD, outputting structured JSON reports that detail domain admins, service accounts, and shadow admin paths for auditing.

Do I need ldap3 to enumerate enterprise and schema admins in my environment?▼

Yes, you need the ldap3 Python library to execute the LDAP queries required to enumerate enterprise and schema admins, resolve nested memberships, and extract servicePrincipalName attributes from your Active Directory environment.

Related Skills

Explore More Software Engineering Skills→
langbyyilangbyyi
96

ldap-injection-testing

Detect, exploit, and remediate LDAP injection vulnerabilities in directory-integrated applications.

Community
Intermediate
AcczdyAcczdy
2

implementing-privileged-access-management-with-cyberark

Audit CyberArk PAM configurations and credentials for rotation gaps and unsafe safes.

Community
Advanced
utsavthakurutsavthakur

active-directory-kerberos-attacks

Execute multi-step Kerberos attacks against Active Directory authentication.

Community
Advanced
kalpmodikalpmodi
18

ad-attacks

Identify and execute Active Directory attack chains to assess domain security.

Community
Advanced