A domain administrator is an account with extensive privileges in a directory service, such as Microsoft Active Directory. It can manage users, computers, policies, and other directory resources, and may control systems across an organization’s network.
Because this access can enable broad and lasting control, attackers may seek domain administrator privileges after obtaining initial access or credentials. Defenders should limit and regularly review privileged accounts, protect their credentials, and monitor for unusual privilege changes or administrative activity. Reaching this level does not by itself prove that every system was compromised, but it is a serious escalation that warrants investigation.