This section describes some of the characteristics of each as they are used in this document. The differences between rights, permissions, and privileges can be confusing and contradictory, even within documentation from Microsoft. Rights, Privileges, and Permissions in Active Directory You should do so because they can be leveraged by attackers to compromise and even destroy your Active Directory installation. Although specific configuration recommendations for securing the highest privilege accounts and groups are provided as separate appendices, this appendix provides background information that helps you identify the users and groups you should focus on securing. Information is also provided about built-in and default accounts and groups in Active Directory, in addition to their rights.

This appendix begins by discussing rights, privileges, and permissions, followed by information about the 'highest privilege' accounts and groups in Active Directory,that is, the most powerful accounts and groups. 'Privileged' accounts and groups in Active Directory are those to which powerful rights, privileges, and permissions are granted that allow them to perform nearly any action in Active Directory and on domain-joined systems. Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012 Appendix B: Privileged Accounts and Groups in Active Directory

Active directory permissions report