Active Directory ACLs and Attack Paths: How Small Permissions Become Domain Admin

1. Introduction

Every object in Active Directory — users, groups, computers, OUs, GPOs — carries a security descriptor with a discretionary access control list (DACL) that decides who can do what to it. Most breaches that end in “domain admin” do not rely on an exploit; they follow a chain of permissions. A helpdesk group can reset a manager’s password; that manager can modify a group; that group has rights over a server admin; and so on until the path reaches a tier-0 asset. Tools like BloodHound made this visible by turning AD permissions into a graph. Understanding ACLs is how defenders find and cut those paths before an attacker walks them.

2. How It Works

Foundational pieces:

• Security principal: any account that can be granted rights (user, group, computer, gMSA).
• SID: the immutable security identifier that actually appears in ACLs (names are just labels for SIDs).
• DACL: the ordered list of Access Control Entries (ACEs) on an object.
• ACE: a single grant/deny of a specific right to a specific SID — possibly scoped to a particular property or child object type via its object GUID.

Object (security descriptor)
  |__ Owner (can always rewrite the DACL)
  |__ DACL
       |__ ACE: [Allow] [SID S-1-5-...] [GenericAll]
       |__ ACE: [Allow] [Helpdesk SID]  [User-Force-Change-Password]
       |__ ACE: [Allow] [SID ...]        [WriteProperty: member]

The rights that create escalation paths:

• GenericAll: full control — do anything to the object.
• GenericWrite: write most attributes (e.g. set SPN for targeted Kerberoasting, or scripts).
• WriteDACL: rewrite the object’s DACL — grant yourself GenericAll.
• WriteOwner: take ownership — owner can rewrite the DACL.
• AddMember (WriteProperty on member): add accounts to a group — instant privilege if the group is powerful.
• ForceChangePassword (User-Force-Change-Password): reset the target’s password without knowing the old one.

3. The Security Problem

Individually these rights look benign — “reset password” is a normal helpdesk function. The danger is composition: a series of small, legitimate rights forms a directed path to a high-value target. Over years of delegation drift, nested groups and one-off fixes, domains accumulate thousands of ACEs, and almost no one has a mental model of the resulting graph. Attackers do: they compute the shortest path from a controlled account to Domain Admins. WriteDACL and WriteOwner are especially dangerous because they let an attacker grant themselves further rights.

4. How Attackers Abuse It (Attack Graphs)

Concept: An attacker collects every ACE, group membership and session in the domain and builds a graph where nodes are principals/objects and edges are abusable rights (e.g. ForceChangePassword, AddMember, GenericAll). Graph analysis then finds the shortest chain from “owned” to “Domain Admins”. Each edge is a normal-looking action; only the path is malicious. This is why path analysis, not single-permission review, is the right defensive lens.

In an authorized assessment, the team maps these paths in the client’s environment to hand over a prioritised list of edges to cut — the value is the graph and the remediation, performed with authorization and without disturbing production identities. This content is for defending your own environment, not compromising anyone else’s.

5. How to Detect It

Command

$u = Get-ADUser -Identity targetadmin; (Get-Acl "AD:$($u.DistinguishedName)").Access | Where-Object { $_.ActiveDirectoryRights -match 'GenericAll|WriteDacl|WriteOwner|GenericWrite' } | Select-Object IdentityReference, ActiveDirectoryRights, AccessControlType

What it does: Reads the DACL of a specific object (here a sensitive admin account) and filters for the high-impact rights.

What to look for: Any non-tier-0 principal holding GenericAll/WriteDacl/WriteOwner/GenericWrite over a privileged object. Those are direct takeover edges.

Defensive use: Spot-check your crown-jewel objects (Domain Admins members, DCs, the AdminSDHolder) for unexpected control.

Command

(Get-Acl "AD:$((Get-ADGroup 'Domain Admins').DistinguishedName)").Access | Where-Object { $_.ObjectType -eq 'bf9679c0-0de6-11d0-a285-00aa003049e2' } | Select-Object IdentityReference, ActiveDirectoryRights

What it does: Inspects the Domain Admins group DACL for the member write right (the object GUID shown is the “member” attribute), i.e. who can add members.

What to look for: Any principal other than expected admins with WriteProperty on member — they can add themselves to Domain Admins.

Defensive use: Confirms only sanctioned admins can modify the most powerful group.

Command

Get-ADObject -Filter 'name -eq "AdminSDHolder"' -SearchBase ("CN=System," + (Get-ADDomain).DistinguishedName) -Properties nTSecurityDescriptor | ForEach-Object { $_.nTSecurityDescriptor.Access } | Where-Object { $_.ActiveDirectoryRights -match 'GenericAll|WriteDacl|WriteOwner' } | Select-Object IdentityReference, ActiveDirectoryRights

What it does: Reviews the ACL on AdminSDHolder, the template whose DACL is stamped onto all protected (admin) accounts by the SDProp process every hour.

What to look for: Unexpected principals with control here — a change to AdminSDHolder propagates to all privileged accounts and is a classic stealthy backdoor.

Defensive use: Detects one of the most impactful and persistent ACL backdoors in AD.

Command

dsacls "CN=Domain Admins,CN=Users,DC=corp,DC=local"

What it does: Native tool that dumps the ACL of a directory object in readable form.

What to look for: Broad “Full Control” or write grants to non-admin principals.

Defensive use: A quick, agentless way to review any object’s permissions during an audit.

6. How to Audit the Environment

• Enumerate ACEs on tier-0 objects: Domain Admins, Enterprise Admins, DCs, AdminSDHolder, the domain root, and the krbtgt account.
• Look for GenericAll/WriteDacl/WriteOwner/GenericWrite and member/ForceChangePassword rights held by non-tier-0 principals.
• Account for nested group membership — effective rights, not just direct ACEs.
• Review OU-level ACEs that grant control over many child objects at once.
• Consider running a graph analysis (e.g. BloodHound Community Edition) against your own domain to visualise paths to tier-0.

7. How to Fix / Harden It

• Remove unnecessary ACEs; apply least privilege and role-based delegation via dedicated OUs.
• Adopt a tiered administration model so tier-0 objects are only controllable by tier-0 principals.
• Reset ownership and clean DACLs on privileged objects; verify AdminSDHolder is pristine.
• Reduce nested-group sprawl and remove stale delegations.
• Re-run graph analysis after changes to confirm paths are actually cut, not just relocated.

8. Detection & Monitoring

• Event ID 5136 (directory object modified) with attribute nTSecurityDescriptor — alert on DACL changes to tier-0 objects and AdminSDHolder.
• Event ID 4728/4732/4756 (member added to security-enabled group) — especially privileged groups.
• Event ID 4724 (password reset attempt) against sensitive accounts — correlate with ForceChangePassword abuse.
• Behavioural: an account suddenly modifying ACLs or group memberships it never touched before.

9. MITRE ATT&CK Mapping

Technique	ID
Account Manipulation	T1098
Domain Policy Modification	T1484
Permission Groups Discovery: Domain Groups	T1069.002
Valid Accounts: Domain Accounts	T1078.002

10. Practical Lab

In an isolated lab:

1. Grant a low-privileged test user ForceChangePassword over another user and AddMember on a group; confirm your Get-Acl audit surfaces both edges.
2. Run BloodHound Community Edition against the lab domain and observe the shortest path to Domain Admins.
3. Remediate one edge (remove the ACE) and re-run collection to confirm the path is cut.
4. Modify AdminSDHolder in the lab, wait for SDProp, and observe the change propagate to protected accounts — then revert and enable 5136 alerting.
5. Add a user to a privileged group and confirm Event 4728/4732 fires.

11. Key Takeaways

• Privilege escalation in AD is usually a path of small legitimate rights, not a single exploit.
• GenericAll, WriteDacl, WriteOwner, GenericWrite, AddMember and ForceChangePassword are the edges to hunt.
• Audit tier-0 objects and AdminSDHolder for unexpected control; account for nested groups.
• Use graph analysis on your own domain to find and verifiably cut paths to tier-0.
• Alert on nTSecurityDescriptor changes (5136) and privileged group additions (4728/4732).

Continue learning: Active Directory security

This guide is part of our Active Directory Security series. Related guides:

• Group Policy Security: SYSVOL, GPO Permissions, and the cpassword Legacy
• Active Directory Delegation: Unconstrained, Constrained, and RBCD Risks
• Active Directory Certificate Services (AD CS): Auditing Templates Before They Become Domain Admin