# Is an issue with AD
**URL:** https://discuss.elastic.co/t/is-an-issue-with-ad/288558
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [November 7, 2021, 8:09am UTC](https://discuss.elastic.co/t/is-an-issue-with-ad/288558 "2021-11-07T08:09:52Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@tbs575](https://discuss.elastic.co/u/tbs575)
#### Post date: [November 7, 2021, 8:09am UTC](https://discuss.elastic.co/t/is-an-issue-with-ad/288558/1 "2021-11-07T08:09:52Z")
set Elasticsearch 7.15 using Windows AD to verify account, and mapping AD group into `xinc_user` role, and it is working,
but now I met problem, not sure if it is issue.
1. login with AD account by kibana
2. check account privileges, found this account beyond two roles,
```auto
GET /_security/_authenticate
{
"username" : "elastic-test",
"roles" : [
"xinc_user",
"superuser"
],
"full_name" : null,
"email" : null,
"metadata" : {
"ldap_dn" : "CN=elastic-test,CN=Users,DC=xinc,DC=lan",
"ldap_groups" : [
"CN=Domain Users,CN=Users,DC=xinc,DC=lan",
"CN=Users,CN=Builtin,DC=xinc,DC=lan",
"CN=sod,CN=Users,DC=xinc,DC=lan"
]
},
"enabled" : true,
"authentication_realm" : {
"name" : "my_ad",
"type" : "active_directory"
},
"lookup_realm" : {
"name" : "my_ad",
"type" : "active_directory"
},
"authentication_type" : "realm"
}
```
I wounder why this account has two role `xinc_user` and `superuser`.
my question:
1. how to remove `superuser` role from this account, I search many documents, no any help.
2. before I set `xinc_user` role have all `Cluster privileges`, but later I removed `all` privilleges from this role, seemed no working, elasticseach did not frefresh this account role after move out `all` form cluser privileges.
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [November 8, 2021, 3:08am UTC](https://discuss.elastic.co/t/is-an-issue-with-ad/288558/2 "2021-11-08T03:08:18Z")
> [@tbs575](#):
>
> how to remove `superuser` role from this account, I search many documents, no any help.
That depends on why this use has the `superuser` role.
1. What do your role mappings look like?
2. Are you using anonymous access?
---
### Author:  [@tbs575](https://discuss.elastic.co/u/tbs575)
#### Post date: [November 9, 2021, 9:10am UTC](https://discuss.elastic.co/t/is-an-issue-with-ad/288558/3 "2021-11-09T09:10:26Z")
1. check role mapping in 'dev tool' with kibana
get /\_security/role\_mapping
```auto
{
"basic_users" : {
"enabled" : true,
"roles" : [
"xinc_user"
],
"rules" : {
"any" : [
{
"field" : {
"groups" : "CN=sod,CN=Users,DC=xinc,DC=lan"
}
}
]
},
"metadata" : { }
}
}
```
1. I don't know what your meaning
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 7, 2021, 9:10am UTC](https://discuss.elastic.co/t/is-an-issue-with-ad/288558/4 "2021-12-07T09:10:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.