Here's what GPT 4.1 had to say 😂

That misconfiguration is extremely bad—as in full domain compromise bad—but whether someone should be fired depends on intent, context, and company culture.

🔥 Why This Is a Critical Risk

Adding “Domain Computers” to “Domain Admins” means: • Every computer account in Active Directory now has full administrative privileges across the domain. • Any attacker that compromises a single computer (even just local SYSTEM) can elevate to full Domain Admin instantly. • A standard user with the ability to join a computer to the domain could potentially create a new computer object and inherit Domain Admin privileges from it. • This grants machines (and potentially users via token leakage or delegation) unintended write access to domain controllers, GPOs, and more.

💀 Real-World Consequences

If an attacker gained access to any domain-joined machine: • They could extract machine credentials from LSASS. • Use Pass-the-Hash or Pass-the-Ticket to impersonate that computer. • Leverage that to become Domain Admin without ever needing to phish or escalate a user account.

This would be considered Game Over in any serious environment.

⸻

🧑‍💼 Should Someone Be Fired?

That’s a leadership and culture question, not just a technical one. Consider: • Was it a junior admin making a bad call under pressure? • Was there a culture of “just make it work” without proper peer review or change control? • Was this change logged or documented at all? • Has this been exploited?

If it was an honest mistake or a bad judgment call to get something working quickly, then it’s a chance to improve processes, not necessarily punish people. On the other hand, if someone knowingly did this and then tried to hide it, that’s much more serious.

⸻

✅ What You Should Do Immediately 1. Remove “Domain Computers” from “Domain Admins” immediately. 2. Audit who made the change (check AD modification logs or use auditing tools like Netwrix, ADAudit Plus, or even Event Viewer if configured). 3. Assume breach: check logs for lateral movement, elevated access from machine accounts, etc. 4. Force machine account password resets (Reset-ComputerMachinePassword) and consider rotating domain admin credentials. 5. Conduct a post-mortem and implement: • RBAC review • Tiered admin model (Tier 0, 1, 2) • Better change management and peer review • Logging and alerts for privileged group modifications

⸻

🔐 TL;DR

Severity: 10/10 Likelihood of compromise: High if not already exploited Firing offense? Maybe—only if it was knowingly reckless or malicious.

But more importantly: fix it now, then build a culture and process that prevents it from happening again.