6.6.1 AD terminology and output fields
§6 — Chapter 6 | 6.6 Study aids
6.6.1.1 SID
A security identifier names a principal. Resolve the account/domain and controlled group membership before treating an ACE as usable.
6.6.1.2 memberOf
A direct membership backlink. It is not a complete list of nested memberships, primary-group relationships or effective rights.
6.6.1.3 SPN
A service principal name associates a Kerberos service instance with an account. It is not a password-strength or reachability result.
6.6.1.4 ACE
One access-control entry: trustee, operation, allow/deny and applicability. It is not the whole effective-access decision.
6.6.1.5 DACL
The discretionary ACL describing access rules on an object. Evaluate the relevant complete rules and trustee context.
6.6.1.6 ObjectAceType
A GUID identifying the attribute, property set or extended operation scoped by an object-specific ACE; interpret it with the right and object type.
6.6.1.7 ActiveDirectoryRights
Operations represented by an AD ACE. A displayed right still needs trustee, deny, inheritance and object-specific applicability checks.
6.6.1.8 SecurityIdentifier
The trustee SID field commonly emitted by PowerView Get-DomainObjectAcl. Resolve it separately; -ResolveGUIDs resolves operation GUIDs, not every principal name.
6.6.1.9 IdentityReference
A principal-reference property used by some ACL APIs. Do not assume every PowerView object emits it; inspect the returned properties when a projection is blank.
6.6.1.10 integrity level
A Windows mandatory-integrity label on the current token. Medium integrity and membership in Administrators do not establish an elevated usable token.
6.6.1.11 token
A process/logon security context. Group attributes, privileges, integrity and network credentials affect different operations.
6.6.1.12 LUID
A locally unique identifier used for a logon session. It is not the domain SID, and another session cache generally needs additional access.
6.6.1.13 TGT
A ticket-granting ticket for a realm, used to request service tickets when its identity, lifetime and KDC conditions are valid.
6.6.1.14 service ticket
A Kerberos ticket targeting a service/SPN. Authentication with it still leaves service authorization to be checked.
6.6.1.15 KDC
The Kerberos key distribution service. Route, realm, DNS/SPN and time failures differ from rejected credentials.
6.6.1.16 effective permission
The operation actually allowed after the current trustee memberships, allow/deny rules, scope, inheritance and object-specific restrictions are considered.
6.6.1.17 authentication
Establishing an identity through a protocol. Success does not automatically permit a share read, remote logon or execution.
6.6.1.18 authorization
The permission decision for the requested object or operation after identity context is established.
6.6.1.19 inconclusive
The available observation cannot establish or rule out the hypothesis. Name the missing evidence and the check that could resolve it.
6.6.1.20 HasSession
A time-sensitive collected computer/user session relationship. Check source, freshness and host control; it does not guarantee readable or reusable credentials.
6.6.1.21 AdminTo
A candidate administrative relationship to a computer. Validate current rights, route, compatible service and token/policy constraints.
6.6.1.22 AddMember
A candidate right to change group membership. Verify the controlled trustee and effective member-write permission, then separately check what membership enables.
6.6.1.23 DCOnly
A SharpHound collection choice focused on DC/directory data. It does not establish live workstation-session coverage.
Use the field together with its object, identity and operation. A vocabulary match alone never proves a useful attack path.