ACL ACL in Active Directory & LDAP 2 — Questions and Answers
Question 1: Which built-in Windows tool automates the process of assigning ACL-based delegated permissions on Active Directory OUs?
- Active Directory Certificate Services
- Delegation of Control Wizard in ADUC (Correct answer)
- Group Policy Object Editor
- Active Directory Sites and Services
Correct answer: Delegation of Control Wizard in ADUC
The Delegation of Control Wizard in ADUC simplifies assigning specific administrative permissions to users or groups on an OU, guiding admins through common delegation scenarios.
Question 2: What does the 'GenericAll' ACE represent in Active Directory?
- A read-only permission for all object attributes
- Full control permission granting all rights over an AD object (Correct answer)
- A permission allowing modification of group membership only
- A system-level permission reserved for domain controllers
Correct answer: Full control permission granting all rights over an AD object
GenericAll is the most powerful ACE in Active Directory, granting complete control over an object including modifying attributes, resetting passwords, and changing the object's ACL.
Question 3: What is a common Active Directory attack technique that exploits misconfigured ACLs?
- Pass-the-Hash
- ACL abuse using overpermissioned ACEs like WriteDACL or GenericAll to escalate privileges (Correct answer)
- Kerberoasting
- DNS poisoning
Correct answer: ACL abuse using overpermissioned ACEs like WriteDACL or GenericAll to escalate privileges
ACL abuse exploits overly permissive ACEs (such as WriteDACL, GenericWrite, or GenericAll) to escalate privileges or take control of accounts in Active Directory.
Question 4: What does the 'WriteDACL' permission allow an attacker to do in Active Directory?
- Read all attributes of an AD object
- Modify the DACL of an object to grant themselves additional permissions (Correct answer)
- Reset the password of any domain user
- Create new Organizational Units in the domain
Correct answer: Modify the DACL of an object to grant themselves additional permissions
WriteDACL allows a principal to modify an object's DACL, enabling an attacker to grant themselves additional rights such as Full Control over that object.
Question 5: In OpenLDAP ACL syntax, what does the 'by' clause specify?
- The LDAP object or attribute being protected
- Who the access rule applies to, such as specific users, authenticated users, or anonymous connections (Correct answer)
- The type of attribute being controlled
- The time of day the rule is active
Correct answer: Who the access rule applies to, such as specific users, authenticated users, or anonymous connections
The 'by' clause in an OpenLDAP ACL defines who the permission applies to, supporting specifiers like `users`, `anonymous`, `self`, or specific DNs.
Question 6: What is the purpose of the 'Protected Users' security group in Active Directory?
- Prevents group members from being added to privileged groups
- Applies authentication restrictions to reduce credential theft exposure for sensitive accounts (Correct answer)
- Restricts logon hours for administrative accounts
- Disables interactive logon for service accounts
Correct answer: Applies authentication restrictions to reduce credential theft exposure for sensitive accounts
Accounts in the Protected Users group cannot use NTLM, DES, or RC4 Kerberos encryption, and credentials are not cached, significantly reducing the attack surface for credential-based attacks.
ACL ACL in Active Directory & LDAP 2
Which built-in Windows tool automates the process of assigning ACL-based delegated permissions on Active Directory OUs?