Reading an Active Directory attack path graph
A list of misconfigured rights convinces nobody. A graph showing that any user is one hop from domain administration ends the discussion in three seconds. Here is how a path is written, how it is scored, and why breadth matters more than severity.
How a path is written
Every path follows the same grammar, and once you can read it you can read all of them:
Domain Admins ← Domain Users [GenericAll]
The target on the left is what gets taken over. The principal on the right is who can take it. The right in brackets is how. Read it aloud: “Domain Admins can be taken over by Domain Users, through GenericAll.” That sentence is the whole finding.
The rights that matter, in plain language
| Right | What it actually allows |
|---|---|
| GenericAll | Full control. Add a member, reset a password, change anything. |
| WriteDACL | Rewrite the permissions — which means granting yourself GenericAll, then using it. |
| WriteOwner | Become the owner, and an owner can rewrite the permissions. |
| DCSync | Ask a domain controller for the password hashes of the whole domain, krbtgt included. |
| ForceChangePassword | Reset the account's password without knowing the old one. |
| GenericWrite / WriteProperty | Write an attribute — enough, on the right attribute, to hijack the account. |
| MemberOf | Not a right but a membership: this is how a path expands from a group to the people actually inside it. |
The first three are equivalent in practice. WriteDACL is not “less serious” than GenericAll — it is one command away from it.
Severity × breadth
Two paths carrying the same right are not the same problem, and this is where most manual reviews go wrong. A path is scored on two axes:
- Severity — 2 for a takeover right (GenericAll, WriteDACL, WriteOwner, Owner, DCSync), 1 for an indirect one, 0 for anything untyped.
- Breadth — 3 when the principal is something everyone belongs to (Everyone, Authenticated Users, Domain Users, Domain Computers), 2 for a built-in group, 1 for a named account.
Score is severity × breadth. Which means a GenericAll held by Domain Users scores 6, while the same GenericAll held by one named administrator scores 2. Same right, three times the exposure — because in the first case the attacker does not need to compromise anyone in particular. Any foothold will do.
The sentence that matters in a debrief: “N of these paths start from a principal every user in the domain belongs to.” If N is greater than zero, the conversation about which control to fix first is over.
Reading the three columns
The graph is laid out in three columns rather than two, and the middle one is the point. On the left, the effective members — the actual accounts inside the group that holds the right. In the middle, the principals that hold it. On the right, the critical objects being targeted. The dotted lines between the first two columns are memberships, resolved in one hop, which answers the question a group name never does: who is that, concretely?
Groups with breadth 3 are deliberately not expanded. Listing the nine thousand members of Domain Users would tell you nothing you did not already know, and would bury the paths that name three people.
Domain takeover
Some paths are flagged separately, and they are the ones to read first: DCSync on the domain head, or a takeover right on a tier 0 object — the administration groups, AdminSDHolder, krbtgt. These are not escalation steps. They are the end of the escalation.
From graph to remediation
The report ships a dsacls plan alongside the graph, with one property that matters: every modifying command is commented out. The audit is read-only, so nothing runs by accident; an administrator uncomments what they have decided to remove, after reading it. The verification commands are active, because reading is safe.
The paths also export to Graphviz and GraphML, which is how you get the diagram into yEd or Gephi to rework it before a presentation. That sounds cosmetic; it is not. This graph is usually the slide that gets the remediation budget approved.
What to do with it, in order
- Close the domain takeovers. There is nothing to arbitrate.
- Close everything with breadth 3 — the rights held by principals everyone belongs to.
- Expand the remaining groups and check who is actually inside them. Half the findings evaporate when the group turns out to hold two service accounts nobody needed.
- Re-run the audit and compare. A graph that empties out is the most readable proof of remediation there is.