AD Access Control and BloodHound Relationships

What this page covers

This page relates access control in Active Directory Domain Services (AD DS) to the relationships shown in BloodHound. Similar terms in the two systems do not necessarily describe the same type of permission.

For example, GenericAll, WriteDacl, and ForceChangePassword appear in the same list, but interpreting them requires distinguishing three layers:

1. Basic access rights defined by Windows as access masks.
2. Rights configured for attributes, property sets, validated writes, and extended rights.
3. Relationship names assigned by BloodHound after analyzing ACEs and AD object state.

The Microsoft and BloodHound sources used here are collected under “Official references” at the end. This content is based on Microsoft Learn and SpecterOps BloodHound documentation as of July 13, 2026.

Key points

GenericAll is a generic access right that can be assigned to an Active Directory object. When mapped to Active Directory rights, it becomes a powerful permission commonly called Full Control.

However, treating every label in BloodHound as the name of a Windows-defined right can be confusing. For HTB, start with these relationships:

Right or BloodHound edge	Meaning	Typical targets
GenericAll	Nearly complete control over the target	User, Group, Computer, OU, Domain, GPO, certificate template
GenericWrite	Can change a broad range of unprotected attributes on the target	User, Computer, Group, OU, GPO
WriteDacl	Can modify the DACL to add other rights	Many AD objects
WriteOwner	Can change the object’s owner	Many AD objects
Owns	The source principal currently owns the object	Many AD objects
AllExtendedRights	Can exercise all extended rights applicable to the target	User, Group, Domain, certificate template, etc.
ForceChangePassword	Can reset the password without knowing the current one	User
AddMember	Can add any member to a group	Group
AddSelf	Can add or remove oneself as a group member	Group
WriteSPN	Can change servicePrincipalName	User, Computer
AddKeyCredentialLink	Can change msDS-KeyCredentialLink	User, Computer
WriteAccountRestrictions	Can change attributes in the Account Restrictions property set	User, Computer
AllowedToAct	The source principal is already allowed RBCD delegation to the target resource	Computer
ReadLAPSPassword	Can retrieve a local administrator password managed by LAPS	Computer
ReadGMSAPassword	Can retrieve a gMSA managed password	gMSA
GetChanges + GetChangesAll	Can retrieve replication data, including secrets, from the domain naming context	Domain
DCSync	An exploitable relationship generated by BloodHound from a combination of replication rights	Domain

More important than the edge name is reading the relationship in this order:

Who
  ↓
Has which object as a target
  ↓
With which access mask, GUID, and inheritance scope
  ↓
Can change which attributes or perform which operations
  ↓
And how that leads to authentication, delegation, group membership, or ACL changes

Read the three layers separately

Security descriptors and ACEs

Each AD object has a security descriptor, which mainly contains:

Element	Contents
Owner	The object’s owner
DACL	ACEs that allow or deny access
SACL	ACEs that define what is audited
ACE trustee	The security principal to whom a right is allowed or denied
ACE access mask	Permission bits such as WRITE_DAC and WRITE_PROPERTY
ObjectType	GUID identifying an attribute, property set, extended right, child object class, etc.
InheritedObjectType	GUID identifying which child object class can inherit the ACE
ACE flags	Direction of inheritance, inherit-only behavior, scope for objects/containers, etc.

Even with the same WRITE_PROPERTY bit, an ObjectType containing the schema GUID for servicePrincipalName applies only to SPNs; without a GUID, it is treated as write access to all properties. Do not judge the strength of a right from the access mask alone.

How DACLs, ACEs, and owners relate

A DACL (Discretionary Access Control List) defines who is allowed or denied which operations on an object. It contains multiple ACEs (Access Control Entries), each of which associates a principal with rights.

Security Descriptor
├─ Owner
├─ DACL
│  ├─ ACE: Allow Judith WriteOwner
│  ├─ ACE: Allow Management GenericWrite
│  └─ ACE: Allow Domain Admins GenericAll
└─ SACL
   └─ Which operations to audit

Term	Meaning
DACL	The full list of ACEs that allow or deny access to an object.
ACE	One allow or deny entry, containing a principal, access mask, target scope, inheritance conditions, etc.
SID	An ID identifying a security principal, such as the user, group, or computer named in an ACE.
Access mask	Permission bits such as GenericAll, WRITE_DAC (WriteDacl), WRITE_OWNER (WriteOwner), and WRITE_PROPERTY (WriteProperty).

For example, a WriteOwner relationship on the Management group conceptually corresponds to this Allow ACE:

Allow judith.mader WriteOwner on Management

This ACE means only that Judith can change the owner of the Management group. It does not make Judith a group member or immediately permit every operation.

Become the owner
≠
Become a group member
≠
Gain all operations on the object

As a rule, an owner has implicit WRITE_DAC to modify that object’s DACL. Thus, WriteOwner can start a chain of rights such as:

Have WriteOwner
  ↓
Make yourself the owner
  ↓
Modify the DACL as owner
  ↓
Allow yourself GenericAll or WriteProperty on the member attribute
  ↓
Change the group's member attribute

The basis for adding arbitrary group members is WRITE_PROPERTY on the member attribute, usually displayed by BloodHound as the AddMember edge. Some tools and materials call the same concept WriteMembers.

There are exceptions to an owner’s implicit WRITE_DAC, including OWNER RIGHTS ACEs and BlockOwnerImplicitRights. AdminSDHolder / SDProp may also reapply ACLs for protected accounts or groups, so check whether the DACL can actually be modified after changing the owner of each target object.

DACL versus SACL

Item	Role
DACL	Defines who is allowed or denied which operations.
SACL	Defines which access is recorded in audit logs.

DACL = Can you do it?
SACL = Should we log it?

Even if the DACL allows access, the details of that operation may not be logged, depending on the SACL and audit policy configuration.

Attributes, property sets, and extended rights

AD object-specific access control mainly includes these types:

Type	Access mask	Meaning of GUID	Example
Per-attribute read/write	READ_PROP / WRITE_PROP	Schema attribute	servicePrincipalName, member
Property set	READ_PROP / WRITE_PROP	Property set grouping multiple attributes	User-Account-Restrictions
Validated write	SELF	Operation subject to server-side validation	Self-Membership, Validated-SPN
Extended right	CONTROL_ACCESS	Control access right for a special operation	Reset Password, replication rights, Certificate Enrollment
Child object operation	CREATE_CHILD / DELETE_CHILD	Child object class	Create a User object, delete a Computer object

Extended rights do not each have their own bit. They are identified by the CONTROL_ACCESS bit and a rights GUID in ObjectType. A CONTROL_ACCESS ACE without an ObjectType GUID means all extended rights applicable to that object, and underlies BloodHound’s AllExtendedRights edge.

Relationships shown by BloodHound

A BloodHound edge is not necessarily the display name of one ACE. SharpHound collects ACLs, object types, property GUIDs, owners, attribute values, and other data; BloodHound normalizes or post-processes them into relationships useful for attack path analysis.

Representative examples:

BloodHound edge	Main basis	Windows classification
GenericAll	ACE allowing Generic All	Generic access right
WriteSPN	WRITE_PROP on the SPN attribute or a corresponding validated write	Attribute / validated write
ForceChangePassword	ACE allowing the Reset Password rights GUID	Extended right
AddSelf	ACE allowing the Self-Membership rights GUID	Validated write
Owns	Owner field of the security descriptor	Object state, not an ACE
AllowedToAct	Source SID present in the RBCD security descriptor	State derived from an attribute value, not a right over the ACL
DCSync	Combination of GetChanges and GetChangesAll	Relationship generated from multiple edges
ADCSESC4, etc.	Right to change a template plus template/CA conditions	Attack path derived from multiple ACLs, attributes, and settings

Thus, edge names, target nodes, and whether an edge is traversable may vary by BloodHound version and collection method.

Basic access rights defined by Windows

Microsoft’s ADS_RIGHTS_ENUM defines the following access masks for Active Directory objects:

Windows constant	Value	Common name	Meaning
ADS_RIGHT_DELETE	0x00010000	Delete	Delete the target object
ADS_RIGHT_READ_CONTROL	0x00020000	ReadControl	Read the security descriptor except for the SACL
ADS_RIGHT_WRITE_DAC	0x00040000	WriteDacl	Modify the DACL
ADS_RIGHT_WRITE_OWNER	0x00080000	WriteOwner	Change the owner
ADS_RIGHT_SYNCHRONIZE	0x00100000	Synchronize	Synchronization access
ADS_RIGHT_ACCESS_SYSTEM_SECURITY	0x01000000	AccessSystemSecurity	Read or set the SACL
ADS_RIGHT_GENERIC_READ	0x80000000	GenericRead	Generic read
ADS_RIGHT_GENERIC_WRITE	0x40000000	GenericWrite	Generic write
ADS_RIGHT_GENERIC_EXECUTE	0x20000000	GenericExecute	Generic execute
ADS_RIGHT_GENERIC_ALL	0x10000000	GenericAll	All generic rights
ADS_RIGHT_DS_CREATE_CHILD	0x00000001	CreateChild	Create a child object
ADS_RIGHT_DS_DELETE_CHILD	0x00000002	DeleteChild	Delete a child object
ADS_RIGHT_ACTRL_DS_LIST	0x00000004	ListChildren	List child objects
ADS_RIGHT_DS_SELF	0x00000008	Self	Perform a validated write
ADS_RIGHT_DS_READ_PROP	0x00000010	ReadProperty	Read a property
ADS_RIGHT_DS_WRITE_PROP	0x00000020	WriteProperty	Write a property
ADS_RIGHT_DS_DELETE_TREE	0x00000040	DeleteTree	Delete a subtree
ADS_RIGHT_DS_LIST_OBJECT	0x00000080	ListObject	Display a specific object
ADS_RIGHT_DS_CONTROL_ACCESS	0x00000100	ExtendedRight	Exercise an extended right

Generic access rights are mapped to standard and directory-specific rights by the GENERIC_MAPPING for the target object type. The conceptual inclusion relationships in AD are:

GenericAll / DS_GENERIC_ALL
 ├─ Delete / ReadControl / WriteDacl / WriteOwner
 ├─ CreateChild / DeleteChild / DeleteTree
 ├─ ListChildren / ListObject
 ├─ Self (validated writes)
 ├─ ReadProperty / WriteProperty
 └─ ControlAccess (extended rights)

GenericWrite / DS_GENERIC_WRITE
 ├─ ReadControl
 ├─ WriteProperty
 └─ Self (validated writes)

GenericWrite allows changes to a broad range of attributes, but it does not automatically include extended rights such as password reset. GenericAll includes changes to the DACL and owner as well as extended rights, so BloodHound treats it as equivalent to Full Control.

Factors affecting effective permissions

Even if an ACE appears to grant powerful rights, the actual access check and outcome depend on:

• Explicit deny ACEs and the canonical ordering of ACEs.
• Trustees in the access token, including user SIDs, group SIDs, and SID history.
• Whether the ACE is direct or inherited from a parent container.
• The ACE’s inheritance flags and InheritedObjectType.
• The attribute, property set, extended right, or child object class specified by ObjectType.
• Object class, schema, system-only attributes, and server-side constraints on validated writes.
• Whether ACL inheritance is disabled on the target object.
• Reapplication of ACLs by AdminSDHolder and SDProp for protected accounts or groups.
• The owner’s implicit READ_CONTROL / WRITE_DAC and exceptions that limit it, such as the OWNER RIGHTS SID and BlockOwnerImplicitRights.
• Whether the operation requires another user right or privilege, protocol, or service configuration.
• Whether replication delay leaves the DC where a change was made in a different state from the DC used to verify it.

The Protected Users group provides protections for Kerberos/NTLM and credential delegation; it does not directly alter ordinary DACL access checks. By contrast, protected accounts and groups subject to AdminSDHolder / SDProp have ACL inheritance disabled and their ACLs periodically reset to match a template.

Therefore, seeing a GenericAll edge does not guarantee that every operation will succeed on every object type or Windows version.

BloodHound rights commonly seen in HTB

Control over an entire object

Edge	Meaning and typical use
GenericAll	Full Control over the target. Depending on its type, this can enable password resets, membership changes, attribute changes, DACL changes, etc.
GenericWrite	Use writable attributes. Usually does not include DACL changes or all extended rights.
WriteDacl	Add GenericAll, attribute-write rights, extended rights, etc. for yourself or a principal under your control.
WriteOwner	Make yourself or a controlled principal the owner, then use the owner’s implicit WRITE_DAC to modify the DACL.
Owns	Already the owner and normally able to use implicit WRITE_DAC; check for restrictions on owner rights.
AllExtendedRights	Corresponds to CONTROL_ACCESS without a GUID restriction and permits extended rights defined for the target.

Because WriteDacl allows modification of the target’s DACL, it can lead to other powerful rights in an attack path. The added ACE must still have the correct object type and inheritance scope, and the target object’s ACL protection must permit the intended effect.

WriteOwner and Owns are different. The former is a right to change the owner; the latter is a BloodHound edge describing the current owner field. An owner also has implicit READ_CONTROL and WRITE_DAC by default, but an OWNER RIGHTS ACE or Windows restrictions on implicit owner rights can limit this path.

Rights over users

Edge	Main operation	Typical effect
ForceChangePassword	Reset Password extended right	Reset without knowing the current password
WriteSPN	servicePrincipalName	Targeted Kerberoasting or SPN configuration changes
AddKeyCredentialLink	msDS-KeyCredentialLink	PKINIT authentication path through Key Trust / Shadow Credentials
WriteAccountRestrictions	Account Restrictions property set	Potential changes to userAccountControl, accountExpires, RBCD attributes, etc.
GenericWrite	Broad range of unprotected attributes	SPNs, key credentials, and other writable attributes
GenericAll	Password, properties, owner, DACL, extended rights	Full Control of a User object
AllExtendedRights	Extended rights applicable to the User	Reset Password, etc.

ForceChangePassword is BloodHound’s exploitable edge for Microsoft’s User-Force-Change-Password extended right, whose display name is Reset Password. It does not require knowledge of the current password.

“Change Password” and “Reset Password” are different:

Operation or right	Current password	Typical user
Change Password / User-Change-Password	Generally required	The account holder
Reset Password / User-Force-Change-Password	Not required	Administrator, help desk, or delegated principal

In Set-ADAccountPassword, a change specifying the old and new passwords is also a separate operation from a reset using -Reset.

Rights over groups

Edge	Meaning	Main Windows basis
AddMember	Add any User, Group, Computer, etc. as a member	WRITE_PROP on the member attribute
AddSelf	Add or remove oneself	Self-Membership validated write
GenericWrite	Change writable attributes, including member	Generic Write mapping
GenericAll	Full Control, including membership and DACL/owner changes	Generic All mapping
WriteDacl	Grant yourself membership-change rights, etc.	WRITE_DAC

AddMember is a relationship that permits adding any principal to the target security group. That principal can use the group’s rights after receiving a new logon token or Kerberos ticket, for example. An existing session’s token is not necessarily updated immediately after the change.

AddSelf corresponds to Microsoft’s Self-Membership validated write and is limited to adding or removing oneself.

Some BloodHound versions or older materials use the plural AddMembers; this guide uses the current edge name, AddMember.

Rights over computers

Edge	Related attribute or feature	Interpretation
AddKeyCredentialLink	msDS-KeyCredentialLink	Can add a key credential to the Computer account
WriteAccountRestrictions	User-Account-Restrictions property set	Can change account restriction attributes, including RBCD
AllowedToAct	msDS-AllowedToActOnBehalfOfOtherIdentity	The source principal is already allowed RBCD to the target resource
ReadLAPSPassword	Legacy LAPS / Windows LAPS password data	Can retrieve the password of a managed local account
ReadGMSAPassword	msDS-ManagedPassword	Can retrieve gMSA password data
GenericWrite	SPN, key credential, account restrictions, etc.	Check which attributes are writable for this target
GenericAll	Entire Computer object	May lead to RBCD, key credentials, LAPS reads, etc.

WriteAccountRestrictions is a BloodHound edge derived from write access to Microsoft’s User-Account-Restrictions property set. It applies to Users and Computers, and the Windows Server 2012 definition includes msDS-AllowedToActOnBehalfOfOtherIdentity as a member.

In particular, modifying that attribute on a Computer object can configure RBCD (Resource-Based Constrained Delegation). AllowedToAct, however, describes a state where the source principal is already allowed in the RBCD security descriptor, not a right to change it.

The actual conditions for retrieving LAPS and gMSA data vary by product version, attribute, encryption settings, authorized decryptor, and ACL. For any edge, establish whether it grants access to a Legacy LAPS clear-text attribute, a Windows LAPS encrypted or clear-text attribute, or a gMSA managed password.

Rights over OUs and domains

For an OU or Domain object, distinguish rights over the object itself from rights inherited by descendant objects.

GenericAll on OU (This object only)
  -> Can modify the OU's own DACL or properties

GenericAll on OU (Descendant User objects)
  -> Rights extend to child Users with inheritance enabled

WriteGPLink on OU
  -> May lead to a GPO application path through gPLink

The main extended rights related to DCSync on a Domain node are:

Extended right	Rights GUID	BloodHound label	Meaning
DS-Replication-Get-Changes	1131f6aa-9c07-11d1-f79f-00c04fc2dcd2	GetChanges	Replicate changes from a Naming Context
DS-Replication-Get-Changes-All	1131f6ad-9c07-11d1-f79f-00c04fc2dcd2	GetChangesAll	Permit replication including secret domain data
DS-Replication-Get-Changes-In-Filtered-Set	89e95b76-444d-4c62-991a-0facbeda640c	GetChangesInFilteredSet	Related to replication of the Filtered Attribute Set

The central combination from which BloodHound normally generates an exploitable DCSync edge is:

GetChanges
+
GetChangesAll
=
DCSync

BloodHound does not treat GetChanges alone or GetChangesAll alone as a DCSync-capable path. GetChangesInFilteredSet also matters when assessing the RODC Filtered Attribute Set or SyncLAPSPassword; distinguish its role from the two core rights for ordinary DCSync.

GenericAll on the Domain object, or applicable AllExtendedRights, may include GetChanges and GetChangesAll, so BloodHound can link them to DCSync.

Rights encountered in AD CS

In AD CS (Active Directory Certificate Services), distinguish these different targets:

ACLs / properties of the Certificate Template object
AD registration object of the Enterprise CA
Administrative security of the CA service
Template publication state and certificate issuance policy

Edge or right	Target layer	Meaning
Enroll	Certificate template / Enterprise CA	Allows certificate enrollment
AutoEnroll	Certificate template	Allows automatic enrollment through Group Policy, etc.
GenericAll	Template/CA-related object in AD	Allows broad changes to the target AD object
GenericWrite	Template/CA-related object in AD	Allows changes to template attributes, etc.
WriteDacl	AD object	Allows changes to the DACL of a template/CA-related object
WriteOwner	AD object	Allows changes to the owner of a template/CA-related object
WritePKINameFlag	Certificate template	Allows changes to msPKI-Certificate-Name-Flag
WritePKIEnrollmentFlag	Certificate template	Allows changes to msPKI-Enrollment-Flag
EnrollOnBehalfOf	Template and enrollment agent conditions	Relationship allowing enrollment for another principal
ManageCA	CA service	Manage CA settings as a CA Administrator
ManageCertificates	CA service	Manage request approval, denial, revocation, etc. as a CA Officer

A certificate template is an AD object and has an ACL like other AD objects. The CA checks Enroll permission on the template and does not issue a certificate based on it if the requesting principal lacks that permission. Actual enrollment requires the template to be published to an Enterprise CA, the requester and CA to meet the necessary read/enroll conditions, and issuance requirements to be satisfied.

ManageCA and ManageCertificates are not equivalent to simply having GenericAll on the pKIEnrollmentService object. The former are roles and permissions on the CA service, assessed separately from the template object’s AD ACL.

BloodHound does not display a single ACE directly as ESC4. It analyzes template owners, DACLs, generic rights, per-attribute write rights, and template/CA configuration, aggregating them into attack paths such as ADCSESC4. Some edges, such as WritePKINameFlag alone, do not establish privilege escalation without a combination of other template flags, EKUs, issuance requirements, and publish/enroll conditions.

Why there is no single list of “all rights”

Active Directory has attributes, property sets, validated writes, and extended rights that grow with schema and product additions.

Even Microsoft’s list of standard Extended Rights includes, for example:

• Reset Password.
• Change Password.
• Apply Group Policy.
• Certificate Enrollment.
• Replicating Directory Changes.
• Replicating Directory Changes All.
• Replicating Directory Changes In Filtered Set.
• Allowed to Authenticate.
• Send As.
• Receive As.
• Create Inbound Forest Trust.
• Domain Administer Server.
• Reanimate Tombstones.

controlAccessRight objects, which let administration tools resolve display names and GUIDs, are registered in the following container in the Configuration naming context:

CN=Extended-Rights,CN=Configuration,<ForestRootDN>

The access check for an extended right uses the CONTROL_ACCESS bit and rights GUID. According to Microsoft’s protocol specification, a controlAccessRight object helps administration tools identify a right, but the object itself does not have to exist for the access check.

Installing Exchange, LAPS, AD CS, or other products that extend the schema adds environment-specific attributes and control access rights. For a complete list, enumerate the target forest’s schema and Extended-Rights container.

Enumerate extended rights in a domain

In a safe test environment or for administrative purposes, you can inspect them as follows:

$configurationNamingContext = (
    Get-ADRootDSE
).configurationNamingContext

Get-ADObject `
    -SearchBase "CN=Extended-Rights,$configurationNamingContext" `
    -LDAPFilter "(objectClass=controlAccessRight)" `
    -Properties displayName, rightsGuid, validAccesses |
    Sort-Object displayName |
    Select-Object displayName, rightsGuid, validAccesses

To find particular rights:

Get-ADObject `
    -SearchBase "CN=Extended-Rights,$configurationNamingContext" `
    -LDAPFilter "(objectClass=controlAccessRight)" `
    -Properties displayName, rightsGuid |
    Where-Object {
        $_.displayName -match "Password|Replication|Certificate|LAPS"
    } |
    Select-Object displayName, rightsGuid

Property sets and validated writes are also represented by the controlAccessRight class. Inspect validAccesses to distinguish whether an entry is used as CONTROL_ACCESS, WRITE_PROP / READ_PROP, or SELF.

Inspect an object’s ACL

On an administration host with the Active Directory provider, you can inspect an object’s ACEs.

Import-Module ActiveDirectory

$targetDn = "CN=Example User,OU=Users,DC=example,DC=com"

(Get-Acl -Path "AD:\$targetDn").Access |
    Select-Object IdentityReference,
                  ActiveDirectoryRights,
                  AccessControlType,
                  ObjectType,
                  InheritedObjectType,
                  InheritanceType,
                  IsInherited

Without resolving GUIDs to display names, it is easy to miss the meaning of attribute-scoped ACEs and extended rights. During an investigation, build a GUID map from the schema naming context and Extended-Rights container, or compare multiple views such as BloodHound, ADSI Edit, and dsacls.

Order of study

For CPTS and HTB, the following order is practical:

GenericAll
GenericWrite
WriteDacl
WriteOwner
Owns
AllExtendedRights
ForceChangePassword
AddMember / AddSelf
WriteSPN
AddKeyCredentialLink
WriteAccountRestrictions / AllowedToAct
GetChanges + GetChangesAll -> DCSync
Enroll / AutoEnroll / ManageCA / ManageCertificates

After learning the names, examine how each expands for different object types.

Target	Rights and attributes to check first
User	Password reset, SPN, key credential, account restrictions, DACL
Group	member, Self-Membership, DACL
Computer	RBCD, SPN, key credential, LAPS, DACL
OU	ACE inheritance, descendant object type, gPLink
Domain	Replication extended rights, inherited ACEs, AdminSDHolder
GPO	Write access to both the AD object and SYSVOL
Certificate template	Enroll, template flags, EKUs, issuance requirements, publication status
Enterprise CA	Enroll, ManageCA, ManageCertificates, CA flags

Defensive and audit perspective

For defenders, searching only for GenericAll does not sufficiently detect powerful delegations. At a minimum, include:

• WriteDacl and WriteOwner.
• The Owner field and OWNER RIGHTS ACEs.
• WriteProperty, Self, and ControlAccess scoped by GUID.
• ACEs inherited by descendant objects from an OU or Domain.
• Objects with ACL inheritance disabled and those subject to AdminSDHolder / SDProp.
• Rights to change member, servicePrincipalName, msDS-KeyCredentialLink, and RBCD attributes.
• Principals able to read LAPS / gMSA secrets.
• Replication extended rights on the domain root.
• Separate ACLs and roles for certificate templates and CA services.
• Effective trustees, including nested group membership and SID history, not only direct ACEs.

Per-attribute ACEs can look inconspicuous in a GUI, yet BloodHound may show them as powerful attack paths such as WriteSPN, AddKeyCredentialLink, and WriteAccountRestrictions.

For an audit, record more than the presence of an edge:

Source principal SID
Target object GUID / DN / class
Allow or Deny
Access mask
ObjectType GUID
InheritedObjectType GUID
Inheritance flags
Direct or inherited
Owner
DC that processed the change

Related pages

• Kerberos Delegation and SPN Abuse
• LDAP Modify Operations
• Computer Accounts and gMSA Pivot
• Active Directory Recycle Bin
• Active Directory Account Operations and Design Guide
• Certificate Auth

Official references

Microsoft

• ADS_RIGHTS_ENUM enumeration: Standard, generic, and directory-specific access masks for AD objects.
• Directory Services Access Rights: Access rights specific to directory service objects.
• Control Access Rights: Relationship among the CONTROL_ACCESS bit, rights GUIDs, and the Extended-Rights container.
• Extended Rights: Microsoft’s list of extended rights.
• Property Sets: Microsoft’s list of property sets.
• Validated Writes: List including Self-Membership and Validated-SPN.
• User-Force-Change-Password: Reset Password extended right.
• User-Change-Password: Change Password extended right.
• Self-Membership: Validated write that changes one’s own group membership.
• Member attribute: The member attribute that stores group membership.
• Service-Principal-Name attribute: Schema definition of the servicePrincipalName attribute.
• User-Account-Restrictions property set: Property set including userAccountControl and RBCD attributes.
• msDS-KeyCredentialLink: Attribute holding key material and usage information.
• msDS-AllowedToActOnBehalfOfOtherIdentity: Security descriptor attribute used for RBCD.
• msDS-ManagedPassword: Constructed attribute returning a gMSA’s current/previous passwords and other data.
• Windows LAPS architecture: ACL and encryption protection for passwords stored in AD.
• DS-Replication-Get-Changes: Extended right to replicate Naming Context changes.
• DS-Replication-Get-Changes-All: Extended right allowing replication of secret domain data.
• DS-Replication-Get-Changes-In-Filtered-Set: Extended right related to replication of the Filtered Attribute Set.
• Blocking Implicit Owner Rights: Implicit READ_CONTROL / WRITE_DAC for owners and the conditions that limit them.
• Protected Accounts and Groups in Active Directory: AdminSDHolder, SDProp, and disabled ACL inheritance.
• Certificate template concepts: Overview of template locations, versions, and permissions.
• Permissions on Templates: Assessment of template ACLs and Enroll permission.

SpecterOps BloodHound

• GenericAll
• GenericWrite
• WriteDacl
• WriteOwner
• Owns
• AllExtendedRights
• ForceChangePassword
• AddMember
• AddSelf
• WriteSPN
• AddKeyCredentialLink
• WriteAccountRestrictions
• AllowedToAct
• ReadLAPSPassword
• ReadGMSAPassword
• GetChanges
• DCSync
• Traversable and Non-Traversable Edge Types: Relationship among GetChanges / GetChangesAll and post-processed DCSync.
• ManageCA
• ManageCertificates
• WritePKINameFlag