Yeah. Active directory is broken and has been for 25 years so that won’t be fixed. As strange as it sounds, aside from external implications (e.g. smb), a Java

Yeah. Active directory is broken and has been for 25 years so that won’t be fixed. As strange as it sounds, aside from external implications (e.g. smb), a Java web service running as root _shouldnt_ have much impact - if you drop a shell on the host, it shouldn’t be doing anything more than running that one app. So dropping to jboss user or whatever should have no real world impact for low / sophistication attacks, as irrespective of user they’re still going to have access to db credentials etc. There are hypervisor breakouts etc which may be possible if you are root but not std user, but if you’re able to break out of hypervisors via 0day you probably also have privesc 0day. Edit: I say ‘shouldn’t matter’. If it does matter, you’ve probably got architectural issues in system design.