HackBlue

Tools · Active Directory defense · 14 / 23

Dangerous Active Directory permissions: GenericAll, WriteDACL, and how to find them

Understand which object permissions let one account take over another, read ACLs with PowerShell, and review delegations on privileged objects.

11 min read · practice only with authorization

Rights that equal control

Every AD object has an access control list. Some rights are effectively ownership: GenericAll grants everything; GenericWrite allows changing most attributes; WriteDACL allows changing the ACL itself; WriteOwner allows taking ownership and then changing the ACL. On users, the extended right User-Force-Change-Password resets the password without knowing the old one. On groups, WriteProperty on member allows adding anyone.

An ordinary account with one of these rights over a privileged account or group is a direct path to that privilege.

Reading an ACL

Get-Acl on the AD: drive, provided by the ActiveDirectory module, returns the ACL for an object. Filter the access rules for dangerous rights and identities that are not expected administrators. Pay special attention to the domain root, AdminSDHolder, privileged groups, domain controllers OU, and Group Policy objects linked to them.

ObjectType GUIDs identify extended rights and property sets; for example 00299570-246d-11d0-a768-00aa006e0529 is User-Force-Change-Password and bf9679c0-0de6-11d0-a285-00aa003049e2 is the member attribute.

Snippet
Import-Module ActiveDirectory
$dn = (Get-ADGroup 'Domain Admins').DistinguishedName
(Get-Acl "AD:$dn").Access |
  Where-Object { $_.ActiveDirectoryRights -match 'GenericAll|GenericWrite|WriteDacl|WriteOwner|WriteProperty' -and $_.IdentityReference -notmatch 'Domain Admins|Enterprise Admins|SYSTEM|Administrators' } |
  Select IdentityReference, ActiveDirectoryRights, ObjectType, IsInherited

Lab: plant and find a takeover path

In the lab, grant the helpdesk group GenericAll on the AdminSDHolder object or WriteProperty on member for Server Operators. Run the ACL query against those objects and confirm the entry appears. Then remove it with Set-Acl or through Active Directory Users and Computers, Advanced Features, Security tab.

Note how an innocuous-looking delegation to helpdesk becomes a route to privileged membership. Graph tools make these chains visible across thousands of objects, covered later in this set.

Good delegation practice

Delegate on OUs that contain only the objects intended, with the narrowest right, such as reset password on user objects in the Staff OU. Never delegate on the domain root or on objects in protected groups. Record each delegation with a ticket.

Audit changes to ACLs on sensitive objects with Directory Service Changes auditing and SACLs, which produce Event 5136 with the old and new security descriptor.

Diagram

Rights that turn into takeover

One ACE can be a full escalation path.

  • GenericAll

    Full control of the object.

  • WriteDACL

    Grant yourself any right.

  • WriteOwner

    Take ownership, then rewrite the ACL.

  • Force change password

    Reset a user’s password.

  • Write member

    Add anyone to the group.

Check yourself

1. Which right lets an account grant itself any other right on an object?

2. Helpdesk has WriteProperty on member for Server Operators. What can they do?

3. Which event records ACL changes on directory objects with the right auditing?