Detect Privilege Escalation for Local Groups

[heath_higgins]

Hi,

Performing IDR tuning and noticed that when performing Privilege Escalation for local groups (Print Operators, Backup Operators, Built-in Administrators) we are not receiving alerts. Is this expected behavior?

Thanks

[david_smith]

@heath_higgins we have an alert named

Account Privilege Escalated, have you verified that this is set to Alert?

David

[heath_higgins]

@david_smith - yes it is enabled and works when escalating against privileged domain groups. it does not work on local privileged groups.

[david_smith]

@heath_higgins do you see the log events in AD Admin activity when these actions are taken?