To protect domain controllers from ransomware, control what can change on them, not just who can sign in. Mimic Networks puts a node on each domain controller. With protections turned on, it locks Group Policy permissions and blocks stops and restarts of critical services. It reports directory changes and credential-theft patterns to DashCam and shows who holds rights on the objects that control the forest.
10
AD reports in DashCam
13
Tripwires on directory changes, six Critical by default
0
Installs on user laptops or desktops
The threat
Why do attackers go after the domain controller?
Whoever controls Active Directory controls every server and user that trusts it. An attacker who takes a domain controller can push a payload to every domain-joined computer through Group Policy, pull every password hash and make any account an administrator.
Domain controller breached
>78%
Human-operated attacks in which the attacker breaches a domain controller.1
Domain controller spreads it
>35%
Cases in which a domain controller is the primary device spreading ransomware at scale.1
Time to Active Directory
11hrs → 3.4hrs
Median time from first access to the first attempt on Active Directory, 70% faster in a year.2
- 1 Microsoft Security blog, 9 April 2025. Microsoft doesn't publish the method behind these figures.
- 2 Sophos Active Adversary Reports, 2025 and 2026. Medians: the 2026 report covers 661 incident response and MDR cases from 1 November 2024 to 31 October 2025, the 2025 report 413 cases from 2024.
On the domain controller
What does Mimic do on a domain controller?
One Mimic node runs on each domain controller and does three jobs. Nothing installs on user laptops or desktops, so there's no workstation rollout to plan.
Enforce deny rules.
With protections turned on, the node denies changes at the directory's control points. It can also revert membership changes to Mimic-protected groups.
Report directory changes.
Ten reports in DashCam record directory changes and credential-theft patterns. Thirteen tripwires raise the score on the changes that matter.
Show who holds the rights.
AD Permissions lists every right on the four kinds of object that control the forest, as each domain controller reports them.
Deny rules
What does the node block?
Deny rules target processes and resources, not accounts. An attacker holding domain admin rights still faces them. They act once you apply a configuration with protections turned on.
An attacker with domain admin rights tries to
Edit Group Policy permissions
On the directory object and its SYSVOL files.
DenyStop or restart a domain controller service
Critical domain controller services, with protections on.
DenyChange files in SYSVOL or NETLOGON
A rule denies the change, or allows it with an alert.
Deny or alert
Reverting membership changes to Mimic-protected groups
When the node is set to revert, it undoes a membership change to a Mimic-protected group automatically, in seconds to minutes. Revert isn't a block: it undoes the change after it lands, and DashCam's Group Changes report records each one.
Mimic-protected groups are nine built-in groups (Domain Admins, Enterprise Admins, Schema Admins, Domain Controllers, Administrators, Account Operators, Server Operators, Print Operators and Backup Operators) and any group you add.
Tripwires
Which directory changes count as Critical?
Thirteen tripwires mark specific directory changes as notable. Six are Critical by default: the moves that turn one account into control of the domain.
Critical tripwire and why it matters
Shadow Credentials set
Lets an attacker sign in as the account, through msDS-KeyCredentialLink.
SID History injected
Grants another account's rights silently.
Resource-Based Delegation set
Lets a controlled machine impersonate users to a target.
Mimic-protected group membership change
Seen on the group and on the account, nested members included. The node can revert it in seconds to minutes.
AdminSDHolder change
Tampering with the template that protects admin accounts.
ADCS certificate template change
Attackers abuse templates to issue admin credentials.
High · 5
- ACL change on a Tier-0 object
- SPN added to a user
- Delegation target change
- userAccountControl change
- GPO modified or linked
Info · 2
- Credential reset
- ACL change on other objects
How a report reaches Critical
Each tripwire that fires adds points: a floor for firing at all, more as it fires more often, up to a cap. Critical tripwires score 10 to 55, High 5 to 35 and Info up to 5. A report's points cap at 100 and land in a band, so outside DC Sync no single pattern reaches Critical alone.
Clear
<1
Low
1 to 19
Review
20 to 49
Elevated
50 to 79
Critical
80+
DC Sync differs. The node reports replication only from sources outside your configured domain controllers and sync servers, so each record is notable by design.
Tripwires raise a report's score. They don't alert on their own: alerts come from notification rules your team builds.
DashCam reports
What does DashCam report?
Ten reports detect and record directory activity. None of them block; the node does the blocking. Five of them score risk.
- 01Event CatalogEvery AD record type, rolled up hourly. The place to start.Scored 0 to 100
- 02USN ChangesPer-object attribute changes and the 13 tripwires.Scored 0 to 100
- 03Group ChangesMimic-protected group changes, including reverts.Scored 0 to 100
- 04DC SyncReplication from unlisted sources. Each is notable.Critical or High
- 05Scheduled Task CreatedNew tasks. Location and author drive the score.Scored 0 to 100
- 06Kerberos Service TicketRC4 service tickets, a Kerberoasting indicator.Indicator counts
- 07LDAP ChangesRaw LDAP attribute changes, by object and DC.Records
- 08DC InventoryPer-DC health and master roles. Stale DCs show up.Findings
- 09Forest InventoryThe forest, every DC and every GPO, refreshed daily.Snapshot
- 10AD PermissionsRights on four kinds of Tier-0 object, per DC.Snapshot
Scope
Narrow to one domain controller, or widen to every sub-tenant.
Export
PDF, Word, PowerPoint or CSV. Every row opens its events.
AI assistant
Plain-English answers, each linked to its DashCam page.
Who signs in to a domain controller
DashCam also shows who signs in to a domain controller. Session Changes, under Server Activity, records logons, logoffs, locks, unlocks, RDP and console connects on each domain controller, by host, type, user and client IP. Interactive logons there should be rare.
Tier-0 permissions
Who holds the rights that control the forest?
Permissions on four kinds of object decide who can run DCSync, reset the password of every protected admin account and link Group Policy that reaches domain controllers or, through a site, every computer in it.
Domain rootDC=example,DC=com
Who can run DCSync to pull every password hash, and who can link Group Policy at the domain level.
Domain Controllers OUOU=Domain Controllers
Who can link Group Policy that every domain controller applies.
AdminSDHolderCN=AdminSDHolder,CN=System
Who can control every protected admin account and reset its password. AD copies its permissions onto all of them.
Site objectsCN=<site>,CN=Sites,CN=Configuration
Who can link Group Policy that every computer in the site applies, whatever its domain, domain controllers included.
Microsoft documents both mechanisms. Group Policy linked to a site applies to all computers in that site, whatever domain holds them.3 SDProp runs every 60 minutes by default on the PDC emulator and resets the permissions of protected accounts and groups to match AdminSDHolder.4
Grants made before anyone was watching
The Tier-0 tripwire records a permission change when it happens. AD Permissions shows the grants already in place, including ones made years before anyone installed Mimic. A grant nobody has touched never trips a tripwire, and it still works.
It lists the owner, DACL protection and every access control entry on these objects, as each domain controller reports them, plus every Group Policy link a domain controller could pick up.
Ask the assistant
"Who holds GenericAll or WriteDacl on AdminSDHolder in any domain?"
Either right can rewrite the permissions SDProp copies onto the domain's protected accounts and groups within 60 minutes by default. Ask about the owner and WriteOwner too. By default an object's owner holds WRITE_DAC, so it can grant itself rights, and WriteOwner lets an account make itself the owner.5
See who holds the rights on your own Tier-0 objects.
Deployment
How does it deploy and run?
One Mimic node goes on each domain controller, and nothing on workstations. Enable the AD engine in its configuration; DashCam flags any domain controller without it.
Active Mode
In Active Mode, the node observes and reports.
Protections on
It enforces once a configuration with protections turned on is applied.
Maintenance Mode
In Maintenance Mode, Mimic suspends enforcement and keeps monitoring. On exit, the node can re-learn the system, observing without blocking, before enforcement resumes.
What runs on the domain controller
On Windows, Mimic's enforcement driver passes Microsoft's Hardware Lab Kit tests and carries Microsoft's dashboard signature, which Windows Server 2016 and later require.6
On a domain controller, enforcement runs as a file system mini-filter driver, with the enforcement logic in a WebAssembly sandbox implemented in Rust. Domain controllers need Windows Server 2016 or later. No reboots required. Enforcement overhead is tunable.
Running it means reviewing reports and building notification rules, since no AD-specific rules ship built in.
Before you rely on a result
Where does Mimic stop?
Mimic shows who holds which rights on domain roots, the Domain Controllers OU, AdminSDHolder and site objects. That isn't Active Directory posture assessment. Mimic doesn't assess the rest of the directory's configuration, use behavioral analytics or recover forests.
Five limits to know before you rely on a result
01Absence is never proof.
A domain controller, role or master-role holder missing from DashCam means it isn't monitored, not that it doesn't exist.
02Snapshot, not detection.
Forest Inventory shows the forest as of its last export. Detections come from the event reports. DashCam flags an export older than two days as stale.
03Tier-0 matching is by name.
The Tier-0 tripwire matches by distinguished-name shape. It misses custom Tier-0 OUs and doesn't show the new ACL value, so a hit is a reason to review, not a confirmed attack. AD Permissions shows the new ACL for its four objects after its next refresh, daily by default.
04Four objects, not the directory.
AD Permissions covers domain roots, the Domain Controllers OU, AdminSDHolder and site objects. It shows state, carries no risk score and doesn't review the rest of the directory's configuration.
05Coverage follows configuration.
A domain controller without an enabled AD engine produces no AD detections. DashCam badges it so the gap shows.
Assessment, identity threat detection, auditing and recovery are other layers. See how the layers of Active Directory security fit together.
FAQ
Questions about protecting domain controllers
How does Mimic protect domain controllers from ransomware?
Mimic Networks puts a node on each domain controller. With protections turned on, its deny rules lock Group Policy permissions, block stops and restarts of critical services and can deny changes to files in SYSVOL and NETLOGON. The rules target processes and resources, not accounts, so a stolen domain admin credential still faces them. The node also reports directory changes to DashCam.
What runs on the domain controller, and is it signed?
One Mimic node per domain controller, on Windows Server 2016 and later. On Windows, Mimic's enforcement driver passes Microsoft's Hardware Lab Kit tests and carries Microsoft's dashboard signature, which Windows Server 2016 and later require. The driver is a file system mini-filter, and the enforcement logic runs in a WebAssembly sandbox. No reboots required.
Which groups does Mimic protect?
Nine built-in groups: Domain Admins, Enterprise Admins, Schema Admins, Domain Controllers, Administrators, Account Operators, Server Operators, Print Operators and Backup Operators, plus any group you add. DashCam calls them Mimic-protected groups. A membership change to one is a Critical tripwire, and the node can revert it in seconds to minutes. By default, Active Directory's SDProp also covers all nine, along with Key Admins, Enterprise Key Admins, Read-only Domain Controllers, Replicator and the Administrator and krbtgt accounts.
What happens when we need to change a protected object legitimately?
Put the node into Maintenance Mode and make the change. In Maintenance Mode, Mimic suspends enforcement and keeps monitoring. On exit, the node can re-learn the system, observing without blocking, before enforcement resumes. For the SYSVOL and NETLOGON shares, rules can also allow specified changes and raise an alert instead of blocking them.
How is this different from EDR on a domain controller?
EDR watches process behavior and decides whether activity looks malicious. Mimic's node asks whether a change to the directory's control points was authorized. With protections turned on, its deny rules block the ones they cover, whatever the credential. It also scores directory changes against named tripwires and shows who holds rights on Tier-0 objects. It runs alongside EDR, not instead of it.
What does AD Permissions show that change auditing can't?
The rights that never changed. Change auditing, and Mimic's own Tier-0 tripwire, record a permission change when it happens, so a grant made before anyone was watching never appears in a change log. AD Permissions lists every right on the domain roots, the Domain Controllers OU, AdminSDHolder and site objects as of its last refresh, including a delegation nobody has reviewed in years.
Does DashCam show who logs on to a domain controller?
Yes, under Server Activity rather than the AD reports, because it covers any Windows server. Session Changes records logons, logoffs, locks, unlocks, RDP and console connects on each domain controller, by host, type, user and client IP. Interactive logons on a domain controller should be rare, so each one is worth a look.
Sources
- Microsoft Security blog, "How cyberattackers exploit domain controllers using ransomware," 9 April 2025.
- Sophos, "Nowhere, man: The 2026 Active Adversary Report," 661 cases, 1 November 2024 to 31 October 2025. Sophos, "It takes two: The 2025 Sophos Active Adversary Report," 413 cases from 2024.
- Microsoft Learn, "Group Policy on sites," archived documentation, updated 8 October 2009.
- Microsoft Learn, "Appendix C: Protected Accounts and Groups in Active Directory," updated 12 May 2025.
- Microsoft Learn, "AD DS: Owner Rights," updated 2 July 2012. Microsoft Learn, "Standard Access Rights," updated 10 July 2025.
- Microsoft Learn, "Driver signing options and best practices," updated 14 April 2026.
All sources accessed 21 October 2026. Product details describe Mimic and DashCam as of October 2026.