Use alternative Active Directory server to gain administrative privileges

Question

I have this idea, just want to see if it is implementable or not.

Let say I have my office laptop, with no administrator privileges, using example domain ASDF

Can I set at my home, another AD server (Microsoft or Samba 4), that have the same domain ASDF as my office laptop.

Then I set an administrative user in my own AD server.

Theoretically, is it possible to authenticate my office laptop with my own AD?

If the above is possible, theoretically, is it possible to gain administrative privileges also with this setup?

Thanks.

score 3 · Answer 1 · answered Oct 28 '13 at 02:52

3

No. What you are describing will not work. The domains will have different SIDs and will not have an object for your computer account in it.

answered Oct 28 '13 at 02:52

MDMarra

100,183
32
195
326

score 2 · Answer 2 · answered Oct 28 '13 at 02:52

2

Nope. Having the same name on the domain does not mean the same domain. The malicious domain controller you set up at home is not on the domain, and is not capable of making any changes.

answered Oct 28 '13 at 02:52

Shane Madden

112,982
12
174
248

score 2 · Accepted Answer · answered Oct 28 '13 at 13:53

Assuming I understand your question's intent that you want admin rights to YOUR company laptop and not the company's AD domain itself...

Can I set at my home, another AD server (Microsoft or Samba 4), that have the same domain ASDF as my office laptop.

Sure, this is totally possible. You CAN setup a domain at home named ASDF...nobody will stop you.

Then I set an administrative user in my own AD server.

Again, sure...you can create any AD user you want on your own AD domain.

Theoretically, is it possible to authenticate my office laptop with my own AD?

Yes...IF you have a way to remove your office laptop from the existing domain and add it to your home ASDF domain. The problem here is your "catch 22". You don't already have local admin rights, which is required to remove yourself from the domain, reboot into a workgroup as a local admin, and then add your computer to the new home domain.

If the above is possible, theoretically, is it possible to gain administrative privileges also with this setup?

Sure...but again your catch 22 is described above.

Thanks @TheCleaner. You understand my question perfectly. Also +1 for the "cache 22" scenario. — Sharuzzaman Ahmat Raslan, Oct 29 '13 at 15:40

Use alternative Active Directory server to gain administrative privileges

3 Answers3