AdminSDHolder DACL Modification

AdminSDHolder is the Active Directory Domain Services object in each domain's System container whose security descriptor serves as a permissions template for protected accounts and groups. By default, SDProp runs every 60 minutes on the domain controller holding the PDC Emulator role and resets protected-object permissions to match the AdminSDHolder template. Unauthorized changes to this DACL can grant continuing permissions on protected objects after SDProp propagates the template. This maps broadly to ATT&CK T1098 Account Manipulation; it is not T1098.007, which covers adding accounts to local or domain groups.