Remediation Action Catalog
Every change Select Fire™ can make in Active Directory and Entra ID, the safety rails that apply to each one, and what each one records.
Requires role: Operator (authorize actions on Critical or High targets); Admin (authorize any action, and set up remediation credentials)
Related: Fix Kerberos Delegation Findings | Select Fire™ | Semi-Auto Execution | Multi-Agent Intelligence | Critical Junctions | Detection Alerts | Bridge Configuration
Overview
This catalog lists the actions Select Fire runs in Semi-Auto and Full-Auto. You choose the change in Select Fire, simulate it, and authorize it. The change is then made in the directory for you, so you don't copy a script and run it by hand.
Every action:
- Is checked against the safety rails before anything is sent
- Records the object's state before and after the change
- Writes a permanent entry to the remediation history
An action with several steps, such as quarantining an account in both Active Directory and Entra ID, runs its steps in order. See Cross-Platform Identity Quarantine.
NOTE
Safe Mode, which gives you a script to run yourself, doesn't need the credentials in this guide. This guide covers the actions GraphnAI runs for you.
Prerequisites
- Remediation credentials: An Admin sets up a write account for each domain before any action can run. See Configuring Remediation Credentials.
- Entra ID write app: Entra ID actions need a separate app registration with write permissions. See Entra ID write app registration.
- Bridge connected: Active Directory actions run through the domain's Identity Bridge.
Requesting Least-Privilege Provisioning
Not yet available. Least-privilege provisioning, which finds the safest way to grant access, isn't available in Graphne or Select Fire yet. Select Fire removes access only.
When it arrives, it will compare the ways to grant the same access (a group membership, a direct permission, or a role assignment). It will simulate each one, flag any path through a Critical Junction, and rank them by the Operational Safety Metric™.
Executing Remediation Actions
After you review a simulation in Select Fire, choose Semi-Auto or Full-Auto to run the action. Each action is checked against the safety rails, its current state is captured, and it's sent to the bridge (for Active Directory) or to Microsoft Graph (for Entra ID).
Each table lists the action as Remediation History names it, its type name, what it does, and whether undo can reverse it. See Reversibility Badges for what the undo classes mean.
Supported action types
Active Directory: account flags
| Action | Type | What it does | Undo |
|---|---|---|---|
| Disable user | DISABLE_USER | Sets UAC bit 0x0002, so the account can't sign in | Reversible |
| Enable user | ENABLE_USER | Clears UAC bit 0x0002, so a disabled account can sign in again | Reversible |
| Block delegation | SET_NOT_DELEGATED | Sets UAC bit 0x100000, so the account can't be used for Kerberos delegation | Reversible |
| Allow delegation | CLEAR_NOT_DELEGATED | Clears UAC bit 0x100000 | Reversible |
| Require smart card | SET_SMARTCARD_REQUIRED | Sets UAC bit 0x40000, so interactive sign-in needs a smart card | Partly reversible: the previous password can't be restored |
| Clear smart card requirement | CLEAR_SMARTCARD_REQUIRED | Clears UAC bit 0x40000 | Reversible from saved state |
Active Directory: Kerberos and password policy flags
| Action | Type | What it does |
|---|---|---|
| Require Kerberos pre-authentication | CLEAR_PREAUTH_NOT_REQUIRED | Clears the pre-authentication exemption. An old Kerberos client that can't pre-authenticate stops working. Modern Windows clients always can. |
| Stop storing a recoverable password | CLEAR_REVERSIBLE_ENCRYPTION | Clears reversible encryption. The recoverable copy stops being written from the next password change, so pair it with requiring a password change. |
| Allow modern Kerberos encryption | CLEAR_DES_ONLY | Clears the DES-only restriction. A client that speaks only the older algorithm stops working. The stronger keys exist only after a new password is set, so pair it with requiring a password change. |
| Require a password | CLEAR_PASSWORD_NOT_REQUIRED | Clears the no-password-required exemption. It takes effect at the next password change, and nothing stops working right away. |
| Apply the password expiry policy | CLEAR_PASSWORD_NEVER_EXPIRES | Clears password-never-expires. If the password is already older than the policy allows, it expires at once. |
All five are Reversible. Each has a matching reverse action, such as "Exempt from Kerberos pre-authentication", that undo uses. You never choose a reverse action yourself. See Remediation Reversibility and Undo.
Active Directory: attributes
| Action | Type | What it does | Undo |
|---|---|---|---|
| Remove the service principal name | REMOVE_SPN | Removes one service principal name from the account, which shrinks what Kerberoasting can target | Reversible from saved state |
| Add service principal name | ADD_SPN | Adds a service principal name | Reversible |
| Clear the stale privileged marker | CLEAR_ADMIN_COUNT | Sets adminCount to 0, so a demoted account stops getting the protected-account permissions | Reversible from saved state |
| Reset password | RESET_PASSWORD | Sets a new password over LDAPS (the unicodePwd attribute, which needs TLS) | Not reversible |
| Change constrained delegation | MODIFY_CONSTRAINED_DELEGATION | Updates msDS-AllowedToDelegateTo to limit where the account can delegate | Reversible from saved state |
| Require a password change | FORCE_PASSWORD_CHANGE | Requires a new password at next sign-in. Anything running as the account fails until someone sets one, so it applies to user accounts only. | Partly reversible: the original password-set date isn't restored |
| Remove the carried-over identifier | REMOVE_SIDHISTORY | Removes one value from the account's SID history, which withdraws every access the account held through it | Not reversible: putting a value back needs a trust relationship and admin rights on the target domain |
Active Directory: structure and permissions
| Action | Type | What it does | Undo |
|---|---|---|---|
| Move to another organizational unit | MOVE_TO_OU | Moves the account to a different organizational unit | Reversible from saved state |
| Remove GPO link | REMOVE_GPO_LINK | Removes one Group Policy link from a container's gPLink attribute. Settings the policy already applied stay on the computers. | Reversible from saved state (undo is "Re-link GPO") |
| Remove group membership | REMOVE_MEMBER | Removes the subject from a group | Reversible from saved state |
| Remove ace | REMOVE_ACE | Removes one permission entry, or one right within it, from an object's permissions, including DCSync. See AD Permission Revocation. | Reversible from saved state (undo is ADD_ACE, which puts the entry back at its original position) |
Active Directory: delegation settings. Run from a Security Posture finding. They run in Semi-Auto only. See Fix Kerberos Delegation Findings.
| Action | What it does | Undo |
|---|---|---|
| Remove an account allowed to act on this object | Removes one account from the object's resource-based delegation setting | Reversible from saved state |
| Clear resource-based delegation | Clears the whole setting | Reversible from saved state |
| Clear unconstrained delegation | Clears the trusted-for-delegation bit | Reversible |
| Clear protocol transition | Clears the trusted-to-authenticate-for-delegation bit | Reversible |
Each has a matching restore action that only runs as an undo. Domain controllers and read-only domain controllers are refused.
Container mode. Run from the Delegation Risk page, REMOVE_ACE can remove the entries that grant a trustee the selected rights at a container in one change, including the copies that apply to the objects below it. It runs in Semi-Auto only, and its undo (ADD_ACE) restores every removed entry at its original position. See Container Removals for the directory update status.
Entra ID (run through Microsoft Graph with the Entra ID write app)
| Action | Type | What it does | Undo |
|---|---|---|---|
| Block Entra sign-in | ENTRA_BLOCK_SIGN_IN | Sets accountEnabled: false, which blocks every new sign-in | Reversible |
| Allow Entra sign-in | ENTRA_UNBLOCK_SIGN_IN | Sets accountEnabled: true | Reversible |
| Revoke Entra sessions | ENTRA_REVOKE_SESSIONS | Calls revokeSignInSessions, which invalidates every active token and session | Not reversible |
| Remove directory role assignment | ENTRA_REMOVE_ROLE_ASSIGNMENT | Deletes a directory role assignment | Reversible from saved state |
| Remove app role assignment | ENTRA_REMOVE_APP_ROLE | Removes an app role assignment | Reversible from saved state |
| Remove OAuth permission grant | ENTRA_REMOVE_OAUTH_GRANT | Deletes an OAuth delegated permission grant | Reversible from saved state |
Across both directories
| Action | Type | What it does | Undo |
|---|---|---|---|
| Quarantine the account | QUARANTINE_IDENTITY | Disables the AD account, then, for a hybrid account, blocks Entra sign-in and revokes Entra sessions | Partly reversible: revoked sessions can't come back |
Cross-Platform Identity Quarantine
Quarantine the account isolates a hybrid identity (Active Directory and Entra ID) during an active attack. It runs three steps in order:
- Disable the AD account: The identity can't sign in to on-premises resources.
- Block Entra sign-in: The identity can't get new cloud tokens.
- Revoke Entra sessions: Every active token and session stops working.
For an account with no Entra ID object, only the first step runs.
What happens when a step fails depends on the action's intent:
- Containment, the usual intent for a quarantine: the steps that finished stay in place, and the action is escalated to a person. A partly contained account is safer than one re-enabled automatically.
- Hygiene: the steps that finished are reversed, last first. If the Entra block fails, for example, the AD account is enabled again.
The receipt's Steps section lists each step and its result, including any step that was reversed.
Safety Rails
A fixed safety list applies to every action. No setting changes it, and it applies whatever the safety score or role.
It answers three different questions, and the answer decides what you can do about a refusal.
Never, by anyone
These have no safe manual form, so they stay blocked even for a person who confirms them.
| Protected object | What's blocked |
|---|---|
| krbtgt (RID 502), and any account named krbtgt | Every change |
| The AD replication account | Password reset, which would break replication |
| The last remaining Global Administrator | Removing the role, once the count shows it's the last one |
| Some permission entries | Removing one that the directory needs for replication, that resets itself, that lives partly in the policy's files, or that would lock out the write account itself. See AD Permission Revocation. |
Blocked for automation; a person can confirm
Automation is refused on these outright. A signed-in person can proceed after confirming the object by typing its name.
| Protected object | What needs confirming |
|---|---|
| Built-in Administrator (RID 500), and any account named Administrator | Disable, enable, move to another organizational unit, password reset, blocking or allowing Entra sign-in, and adding a service principal name |
| Domain Controllers group (RID 516) | Removing a member from it, and removing it from another group |
| Built-in Administrators group (S-1-5-32-544, matched by SID) | Removing a member |
Objects the directory marks critical (isCriticalSystemObject) | Every change |
| GraphnAI's own accounts: the bridge sync accounts, the remediation write accounts and Entra apps, and the app GraphnAI signs in with | Every change |
See Confirming a Change to a Protected Object for the confirmation, including why an API key can never satisfy it.
The full list, with the reason for each entry, is on the Guardrails tab of Admin > AI Provider.
Couldn't be checked
The check didn't finish, so it's not known whether the object is protected. The action is held rather than refused, and it runs on a later try once the fault clears. It's never escalated as a permanent failure, because nothing about the object was established.
That covers a protected list that couldn't be read, a Global Administrator count that couldn't be established, a policy container that couldn't be found or didn't match, and a target that couldn't be resolved. In Select Fire, these show Couldn't check. When GraphnAI's own accounts aren't confirmed yet, the action shows On hold with "The platform's own accounts aren't confirmed yet. Run a sync, then test the remediation credentials."
How a refusal is returned
These checks run before anything is sent to the directory. A blocked action is refused with its reason, so you know whether nobody can run it, a person needs to confirm it, or the check couldn't run.
The safety list fails closed. When the target can't be resolved to check it, the action is held. An action never goes through on an unclear identity lookup.
IMPORTANT
The safety list and the confirmation are both enforced when the action runs, not in Graphne. A recommendation that names a protected object is still checked when it runs. Admins can choose any action, but can't skip the confirmation. Graphne never has the remediation credentials.
Configuring Remediation Credentials
Remediation credentials are separate from sync credentials. Sync reads with a read-only account. Changes need a separate account with write access. If the sync account is ever compromised, it still can't change the directory.
Set them up on Admin > Remediation Credentials. See Semi-Auto Execution for the steps.
AD remediation credentials
The AD write account needs:
- Permission to sign in to the domain over LDAP, with write access
- Delegated rights on the target organizational units to change
userAccountControl,servicePrincipalName,adminCount,msDS-AllowedToDelegateTo,gPLink, and groupmember - For password resets, the Reset Password right and write access to
unicodePwd, over LDAPS (TLS) - For permission entry removals, the right to change permissions (
WriteDacl) or ownership on the objects - For delegation changes, write access to the User-Account-Restrictions property set on the target objects. Clearing unconstrained delegation or protocol transition also needs the user right "Enable computer and user accounts to be trusted for delegation", granted through the Default Domain Controllers Policy. Scope the grant to the organizational units that hold delegation findings, never the domain root. See Required account rights.
Required role: Admin. Credentials are encrypted at rest, and they're masked when shown again.
Validating credentials
Select Validate on the page after you save credentials. It confirms the account can sign in before any action runs, and it lists each Entra ID permission. See Semi-Auto Execution for the results.
Entra ID write app registration
Entra ID actions need an app registration separate from the one used for sync. The write app needs admin consent for these Microsoft Graph application permissions:
| Permission | Needed for |
|---|---|
User.ReadWrite.All | Blocking and allowing sign-in, and revoking sessions |
RoleManagement.ReadWrite.Directory | Removing directory role assignments |
AppRoleAssignment.ReadWrite.All | Removing app role assignments |
DelegatedPermissionGrant.ReadWrite.All | Removing OAuth permission grants |
Set the Entra write credentials for each domain on Admin > Remediation Credentials, under Entra ID. See Setting up the Entra ID write app.
Before/After Audit Trail
Every action captures the relevant attributes before it runs:
| Action | Captured attributes |
|---|---|
DISABLE_USER / ENABLE_USER | userAccountControl, enabled |
SET_NOT_DELEGATED, CLEAR_NOT_DELEGATED, and the smart card actions | userAccountControl |
REMOVE_SPN / ADD_SPN | servicePrincipalName |
CLEAR_ADMIN_COUNT | adminCount |
RESET_PASSWORD | pwdLastSet |
MODIFY_CONSTRAINED_DELEGATION | msDS-AllowedToDelegateTo |
MOVE_TO_OU | distinguishedName |
REMOVE_GPO_LINK | gPLink, read from the container |
ENTRA_BLOCK_SIGN_IN / ENTRA_UNBLOCK_SIGN_IN | accountEnabled |
ENTRA_REVOKE_SESSIONS | signInSessionsValidFromDateTime |
Removing a group membership, a directory role, an app role, or an OAuth grant changes a relationship, not an attribute of the account. For those, the read-back after the change checks the relationship itself.
The before state is in the remediation history, which keeps entries for 2 years. Each entry records the action, the subject, the domain, the result, the times, any steps, and who authorized it.
Troubleshooting
Action denied on a protected account
What you can do depends on the account. See Safety Rails.
For krbtgt and the other "never, by anyone" entries, the refusal is final. No setting or confirmation unlocks it.
For the built-in Administrator, the Domain Controllers group, and the other confirmable entries, the refusal means the request was unattended. A signed-in person can proceed by confirming the object by name. When a script or API key sends a confirmation, the response says the session was unattended. It doesn't report a mismatched name, because the name may have been right and was never read.
Action held because the check couldn't run
GraphnAI couldn't establish whether the object is protected. Usually the target couldn't be resolved, the protected list couldn't be read, or a policy container wasn't found. The action is held, not refused. It runs on a later try once the fault clears, and it isn't escalated as a permanent failure.
Check that the identity has synced. The safety list fails closed, so an action never goes through on a target it can't resolve.
Remediation credentials not configured
The row says "No directory write account is set up for this domain. Add one under Remediation Credentials." or "This domain has no Entra write credentials. Add them in Remediation Credentials." Open Admin > Remediation Credentials, choose the domain, turn on Use these credentials for the directory, and save. See Configuring Remediation Credentials.
A quarantine didn't finish every step
Open the action's receipt on the History tab. Steps shows which step failed and which were kept or reversed. Common causes:
- The Entra write app lacks a required permission. Check its API permissions in the Entra admin center, then select Validate.
- The bridge connection dropped before the AD step finished.
- Microsoft Graph limited the request rate. Requests are retried up to 3 times, with a wait between each.
Password reset fails
A password reset needs LDAPS (TLS). Check that Require TLS (LDAPS) is on in the domain's remediation credentials, and that the bridge host trusts the domain controller's LDAPS certificate.