Convert ownership or DACL control into a narrower useful right

Needs: Correct object/ACE semantics, permission to perform the required intermediate change and a preserved original ACL/owner

PowerShell commands

WriteOwner can make the controlled identity the owner; ownership may then permit a DACL change. WriteDacl can grant only the narrower right needed for the intended transition.

# Baseline
Set-DomainObjectOwner -Identity TARGET_OBJECT -OwnerIdentity CONTROLLED_USER -Verbose
Add-DomainObjectAcl -TargetIdentity TARGET_OBJECT -PrincipalIdentity CONTROLLED_USER -Rights ResetPassword -Verbose

# Group-membership variant
Add-DomainObjectAcl -TargetIdentity TARGET_GROUP -PrincipalIdentity CONTROLLED_USER -Rights WriteMembers -Verbose

# Remove the ACE after the authorized objective
Remove-DomainObjectAcl -TargetIdentity TARGET_OBJECT -PrincipalIdentity CONTROLLED_USER -Rights ResetPassword -Verbose

Export the original owner/security descriptor before changing it and restore exactly that state. Password resets, membership changes, SPN writes, ownership changes and ACE grants are state changes; do not execute merely because a graph shows an edge.

Verify → Verify the intermediate owner/DACL state and final operation separately; restore original state afterward.

If it fails → Protected-object behavior, scope/inheritance or a missing intermediate right can break the chain. More detail ↓

If → then

A controlled trustee has the effective password-reset right on a useful account → Reset a target account password through a validated directory right
Needs: Exact object/right and account state; the disruptive password change is justified within the assigned lab objective
A group member-attribute write or equivalent effective right → Add a controlled identity to a group through effective membership rights
Needs: Exact target group, controlled principal, useful resulting right and a fresh token/logon context
A controlled principal can write a user's servicePrincipalName → Create a temporary SPN through an effective object right
Needs: Effective SPN-property right, compatible account, unique temporary SPN, authenticated TGS request and exact cleanup

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Convert ownership or DACL control into a narrower useful right

USE WHEN: Effective WriteOwner or WriteDacl on a useful directory object
STARTING ACCESS: A domain identity, appropriate host privilege, or a validated effective directory-object right
RESULT: A verified specific right enabling another identity transition

Recognize the clue

Inspect resolved ownership/DACL rights on the exact useful object and separate the intermediate right from the final desired operation.

Get-DomainObjectAcl -Identity TARGET_OBJECT -ResolveGUIDs

SYNTHETIC EXAMPLE OUTPUT

Trustee: CONTROLLED_PRINCIPAL
Effective right candidate: WriteOwner or WriteDacl

Means: Ownership/DACL control may enable a narrower useful ACE; it is an intermediate capability.

Confirm: Validate actual owner semantics, deny/protected-object behavior, ability to grant the next right and original-state restoration.

After validation: The intermediate operation and narrow effective right are established: follow the linked reset/group/SPN method.
Ruled out in this context: The ACE targets another object scope or is ineffective for this trustee: reject that route.
Still inconclusive: WriteOwner text alone does not prove every later DACL modification succeeds.

Troubleshooting: Protected-object behavior, scope/inheritance or a missing intermediate right can break the chain.

WriteOwner can make the controlled identity the owner; ownership may then permit a DACL change. WriteDacl can grant only the narrower right needed for the intended transition.

Export the original owner/security descriptor before changing it and restore exactly that state. Password resets, membership changes, SPN writes, ownership changes and ACE grants are state changes; do not execute merely because a graph shows an edge.

Why it works

Ownership and DACL control are intermediate capabilities. Grant the narrow operation required for the next method and validate that it applies; do not treat ACL text as completed account compromise.

Worked example · hypothetical

Observation: the controlled trustee can change an object's owner. Test: validate whether the new ownership allows the required DACL update. Illustrative output: the narrow reset right is granted and effective. Interpretation: only then select the password transition and preserve cleanup state.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗