Skip to main content
Every AD object carries its own Access Control List (ACL), and the rights granted there are often far more exploitable than they look: write access to an “unimportant” attribute on one user can chain into Domain Admin. These rights are exactly what BloodHound graphs as edges between objects, finding who holds which right over what is really a BloodHound / PowerView enumeration question, this page covers what to actually do once one is found.

​
ForceChangePassword

Reset a user’s password without knowing their current one.

​
GenericWrite

Write access to any non-protected attribute, what that turns into depends on the object type:
  • User: assign an SPN (serviceprincipalname), then run Kerberoasting against an account that never had one.
  • Group: add yourself or another controlled principal as a member.
  • Computer: set up Resource-Based Constrained Delegation.

​
AddSelf / AddMember

Add a principal to a group, yourself (AddSelf) or another (AddMember).
AddSelf means the target can add themselves specifically; AddMember is the broader right to add any principal.

​
GenericAll

Full control over the target object, the same outcomes as GenericWrite plus anything else: change group membership, force a password change, or Kerberoast-enable an account directly.
On a computer object with LAPS deployed, GenericAll also implies ReadLAPSPassword, reading the local admin password is enough for local admin on that machine.

​
Owns / WriteOwner / WriteDacl

These three chain together: owning an object (implicit full control) — or being able to make yourself the owner (WriteOwner), or write a new ACE onto its ACL directly (WriteDacl) — always lets you grant yourself any other right over it, since the owner can always rewrite the DACL.

​
AllExtendedRights

Grants every extended right in one shot, in practice this most often shows up as ForceChangePassword on a user, or, if granted on the domain object itself, the replication rights DCSync needs. Use it the same way as whichever specific right it’s standing in for.

​
ReadLAPSPassword

Read a computer’s local administrator password, if LAPS is deployed.
The Microsoft LAPS PowerShell module (Get-AdmPwdPassword -ComputerName <name>) works the same way with LAPS’s own module loaded instead of PowerView.

​
DCSync

Replicate the domain’s password database. Covered in full on Domain Credential Dumping

​
Quick Reference Tools

BloodHound

Graphs every ACE on this page automatically and chains them into a full attack path.

BloodHound Edges Reference

Full documentation for every edge BloodHound graphs, including ones not covered on this page.