Reported control path does not seem exploitable

[maxime-huyghe]

Hi,
PingCastle reports a control path that looks like this :

[Suspicious user] --member-> [Some Group] --GEN_RIGHT_ALL-> [Organizational Unit] --container hierarchy-> [Admin group] --member-> [Administrators]

However, as it is a member of Administrators, Admin group has its adminCount attribute set to 1.
In my understanding, this means it cannot inherit any permission, and its permissions are periodically reset to AdminSDHolder's.

Given this, I don't understand how Suspicious user could gain any additional privileges.

This seems like it could either be a PingCastle bug or a misunderstanding on my part.