Membership to the Enterprise Admins group must be restricted to accounts used only to manage the Active Directory Forest.

The Enterprise Admins (EA) group is a highly privileged group. To prevent forest-wide credential theft, Active Directory system administrators must strictly adhere to the principles of separation of duties and least privilege. EA group membership must be restricted to dedicated accounts used solely for forest-level management. Authenticating EA credentials on standard workstations or member servers exposes them to harvesting attacks, which can lead to complete forest compromise. Isolating administrative roles and restricting EA account usage directly mitigates these lateral movement and privilege escalation risks.