A Domain Admin Is Logged In, and EDR Is Watching

Enumerate before choosing, because each path fails differently.

SeBackupPrivilege on FS01 lets you copy files and hives without changing ACLs. Quiet, no code injection, but from a file server it mostly yields local SAM and LSA secrets, which is useful only if da-admin material or other credentials are cached there.

Dumping LSASS captures da-admin's session material. Highest value, highest risk. EDR in alert-only mode will not block you, but it will still generate the alert, so their SOC sees a credential-dumping event on a production file server involving a real employee. If their IR team reads that as a live intrusion, you have manufactured an incident.

Offline attacks against other service accounts avoid touching da-admin entirely: slower, no disruption.

Backup account access to repositories holding a domain controller copy is often the shortest legitimate route and worth checking before anything invasive.

I would take the SeBackupPrivilege route and the backup-repository check first, and treat LSASS as a separately authorized action, agreed with the client in writing and ideally with a named SOC analyst told in advance when and from where it will happen. Note also that an active DA session is a moving target: the employee may log off at any moment, so if you do act, act once with a plan for the resulting data before you collect it.

Captured DA material is where authorized tests most often become incidents. The RoE forbids touching the finance forest, and the trust means da-admin's token can authenticate there. Capability you now hold is not permission you have.

So: do not authenticate across the trust, do not enumerate the trusting domain, and do not run a query that leaves the in-scope domain. Establish the risk without crossing it, by inspecting the trust object's direction and transitivity from the in-scope side, and report that a single DA credential at Meridian can reach the finance forest. That is a finding in its own right.

Handle the material as sensitive: store it encrypted, record exactly how and when it was obtained, and do not log in interactively as da-admin, because that writes logon events under a real employee's name and may trip their UEBA or lockout policy. If you must confirm the level, do it once, from your own tooling, and tell the SOC beforehand. Agree credential destruction with the client at debrief.

Order by blast radius reduced per unit of effort, not by the order findings appear in the report.

First, the service account. One guessable seasonal password turned an unprivileged spray into local administrator on a production server. The actionable controls are a managed service account or at minimum a long random secret, removal of local admin from service accounts, and a real lockout or throttling policy, since your two attempts per account were chosen to stay under whatever threshold exists and that threshold is evidently survivable for an attacker too. Evidence: the exact account, the time to compromise, and the privileges obtained.

Second, tier separation. A Domain Admin session on a file server that a compromised service account administers is the actual bridge to domain compromise; local admin rights should not sit on hosts that DA sessions touch.

Third, detection. Alert-only EDR means the client has visibility but no response. Say so plainly with the timestamps your activity generated, because that is the finding their SOC lead will care about most.