Dangerous ACLs in Active Directory: forgotten delegations that lead to Domain Admins
Privileged groups are usually monitored. The permissions that let someone into them, much less so. Over migrations, application installs and one-off delegations, directory access control lists accumulate rights nobody understands any more. They often form the shortest path to domain control.
A permission can equal membership
Every directory object carries a security descriptor: an owner and a discretionary access control list (DACL) made of access control entries (ACEs). Some of those entries grant, directly or in one step, full control of the object. When they apply to a privileged group, an administrative account, the domain object or a domain controller, their holder is effectively an administrator, even without appearing in any sensitive group.
Rights to watch
| Right | What it allows |
|---|---|
| GenericAll (Full control) | Anything on the object: change attributes, reset a password, add members. |
| WriteDACL | Modify the access control list, and therefore grant oneself any other right. |
| WriteOwner | Take ownership of the object; the owner can then modify the DACL. |
| GenericWrite / property writes | Modify sensitive attributes: group members, SPNs, delegation attributes, logon script. |
| Reset password | Change an account's password without knowing the old one and take it over. |
Add members (write to member) | Add oneself or an accomplice to a group. |
| Replication rights on the domain | Request replication of secrets, including password hashes for every account. |
Add to these the rights on Group Policy objects linked to sensitive OUs and on the OUs themselves: controlling a GPO applied to domain controllers means controlling the domain.
Think in paths, not isolated permissions
A single permission often looks harmless: the helpdesk can reset passwords in an OU, an application group can modify another group. The danger comes from chaining. A helpdesk account resets the password of a service account; that account has GenericWrite on a group; that group has WriteDACL on the domain object. Three steps, and a second-line technician becomes a domain administrator.
That is why the analysis relies on graphs: each object is a node, each exploitable right an edge, and you search for paths ending at Tier 0 objects. Attack path analysis tools, including those used by attackers, work this way. Defenders have every reason to run that analysis first.
AdminSDHolder. Protected accounts and groups have their DACL periodically rewritten from the AdminSDHolder object. An ACE added to AdminSDHolder therefore propagates to every protected object: a classic persistence mechanism that should be checked first.
Usual sources of dangerous delegations
- products installed with extended rights on the domain, including some older messaging or directory synchronisation versions;
- delegations made with the delegation wizard at the domain root rather than on a targeted OU;
- object owners left as personal accounts because an administrator created the group or account;
- uncontrolled inheritance: a broad permission on a parent OU applies to sensitive accounts moved beneath it;
- deleted accounts that survive only as SIDs in ACEs, often a sign of a delegation never reviewed.
Cleaning up methodically
- Map the paths leading to Tier 0 objects and rank them by number of steps.
- Handle direct rights on the domain object, AdminSDHolder, privileged groups, domain controllers and their GPOs first.
- Restore a consistent owner (Domain Admins) on sensitive objects.
- Replace broad delegations with delegations on dedicated OUs, granted to groups and limited to the attributes needed.
- Document every delegation you keep and rerun the analysis to confirm the paths are gone.
Test removals on a limited scope: some applications genuinely depend on a right, and it is better to narrow it than to remove it abruptly.
What an audit checks
- non-default ACEs on the domain object, AdminSDHolder and sensitive containers;
- holders of secret replication rights;
- owners of privileged objects;
- attack paths leading to Tier 0 groups and their length;
- modify rights on GPOs linked to domain controllers.