Is it so easy to hack a domain account with admin rights?

Question

Active Directory

Interested, as it were, in two questions:
1. The laptop is in the domain. Can the user of this laptop by any means obtain local admin rights in order to change settings on this laptop, etc.? ? laptop in the domain.
2. Can a normal domain user having a domain account with "Domain User" privileges in some tricky way increase its role to "Domain Admin"?

Answer 1

1. Very easy
   Hence the recommendation - never log on to any PC under the account of the domain administrator! Ideally, do not use this type of account anywhere outside the DC server itself.

Answer 2

If there is physical access, then getting a local admin is a matter of technology (maybe labor-intensive, but real)

Answer 3

Misters, it is possible more in detail about "easy" for the local administrator? If the beech is corporate, it usually has a bios / ufi password-protected, loading from any removable devices is prohibited.

Answer 4

1. Easy. The local administrator is generally easy. But when you connect to a domain, your laptop can pull up the settings from the domain through global policy and they can be overwritten again, on top of what you changed. It is clear that it depends on what the domain admins messed up.
2. difficult/impossible. Depends more on social engineering.