6.2.5 Enumerate and validate effective object permissions
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A selected directory object and a controlled identity whose direct/nested memberships are known.
Where to look: Read the target object security descriptor. Resolve the trustee SID, target object type, right, object-specific GUID, inheritance and relevant deny rules. Trace whether your controlled identity actually reaches the trustee.
Expected behavior / secure boundary: Delegated administration is legitimate when narrowly scoped to intended trustees. Reading an ACL is usually not controlling its target. A powerful-looking ACE for an unrelated principal grants you nothing.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.2.5.1 Baseline — Windows PowerShell
Run: Windows PowerShell with reviewed PowerView. Requires: Read access to the selected object security descriptor; controlled trustee membership must be checked separately. Effect: Reads candidate ACEs; does not change permissions.
Get-DomainObjectAcl -Identity TARGET_OBJECT -ResolveGUIDs |
Where-Object { $_.ActiveDirectoryRights -match 'GenericAll|GenericWrite|WriteDacl|WriteOwner|ExtendedRight|WriteProperty|Self' } |
Select-Object ObjectDN,SecurityIdentifier,ActiveDirectoryRights,ObjectAceType,AceType,IsInherited,InheritanceType
What this checks: The filter selects interesting candidate ACEs, not a complete effective-access calculation. Resolve all applicable rules and the specific attribute/extended right before choosing a transition.
6.2.5.2 Interpret the output
Raw/view evidence first. These are synthetic, abbreviated tool or graph-view excerpts. Graph relationship rows are a representative view, not collector console output. Version-specific wording and spacing can differ. The normalized observations below are a separate interpretation.
Read §6.6.1 — SecurityIdentifier as the trustee field, §6.6.1 — ObjectAceType as the scoped operation/attribute GUID, and §6.6.1 — ActiveDirectoryRights as the represented operations. None alone establishes effective access.
6.2.5.2.1 Expected — raw evidence
Command/view: Filtered Get-DomainObjectAcl projection
The filtered query prints no rows. This sentence is an annotation, not program output.
Decisive clue: No rows in this particular projection/filter.
Supported: No candidate matching this query was displayed.
Still missing: Read coverage, object scope and filter accuracy must be known before ruling out all control paths.
Next check: §6.2.5.1 — Enumerate and validate effective object permissions
6.2.5.2.2 Interesting — raw evidence
Command/view: Selected ACE projection (abbreviated)
ObjectDN : CN=Helpdesk,OU=Groups,DC=example,DC=test
SecurityIdentifier : S-1-5-21-111-222-333-1200
ActiveDirectoryRights : WriteProperty
ObjectAceType : member
AceType : AccessAllowed
IsInherited : False
Decisive clue: member write is shown for a particular trustee SID.
Supported: A group-membership write candidate exists; its connection to a controlled principal remains unverified.
Still missing: Resolve the SID and check controlled direct/nested membership plus applicable deny and scope rules.
Next check: §6.2.1.1 — Baseline enumeration — users and groups
6.2.5.2.3 Failed / inconclusive — raw evidence
Command/view: A copy that projected the wrong trustee property
ObjectDN : CN=Helpdesk,OU=Groups,DC=example,DC=test
IdentityReference :
ActiveDirectoryRights : WriteProperty
ObjectAceType : member
Decisive clue: The projected IdentityReference value is blank.
Supported: This may be a property-selection issue; it does not establish an ownerless ACE or permission denial.
Still missing: Inspect the returned object before projection. Use SecurityIdentifier when that is the emitted trustee field, then resolve the principal.
Next check: §6.2.5.1 — Enumerate and validate effective object permissions
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
ObjectDN: CN=Helpdesk,OU=Groups,DC=example,DC=test
IdentityReference: EXAMPLE\Support
ActiveDirectoryRights: WriteProperty
ObjectAceType: member
AceType: AccessAllowed
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| Support trustee | A group receives the rule. | Prove your identity belongs directly or through nesting. | §6.2.1.1 — Baseline enumeration — users and groups |
| member on Helpdesk | A candidate group-membership modification right. | Check applicable scope/deny rules and what membership would enable. | §6.3.7.1 — Choose a permission-backed identity transition |
| WriteProperty alone | The output may be incomplete or attribute-specific. | Resolve its GUID; it does not mean every property is writable. | §6.2.5.1 — Enumerate and validate effective object permissions |
Stop when: Trustee, applicable right, target type and missing effective-access checks are explicit.
Revisit only when: Membership, object ACL, scope or the controlled identity changes.
6.2.5.3 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | Effective control reaches a useful target: select a narrow permission-backed transition. | §6.3.7.1 — Choose a permission-backed identity transition |
| Ruled out in this context | The trustee is uncontrolled or the ACE does not apply: rule out this path. | §6.2.8.1 — Enumerate using BloodHound and validate relationships |
| Inconclusive / failed check | SID/GUID/inheritance is unresolved: do not perform a speculative modification. | §6.2.5.1 — Enumerate and validate effective object permissions |
6.2.5.4 Tooling and complete procedure
Reviewed PowerView provides readable ACE candidates; native/RSAT/LDAP alternatives are in the canonical mapping procedure. Import the correct module and resolve object GUIDs. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.