ACL ACL in Active Directory & LDAP 2

Question 1

Which built-in Windows tool automates the process of assigning ACL-based delegated permissions on Active Directory OUs?

Accepted Answer

Delegation of Control Wizard in ADUC

Answer

The Delegation of Control Wizard in ADUC simplifies assigning specific administrative permissions to users or groups on an OU, guiding admins through common delegation scenarios.

Question 2

What does the 'GenericAll' ACE represent in Active Directory?

Accepted Answer

Full control permission granting all rights over an AD object

Answer

GenericAll is the most powerful ACE in Active Directory, granting complete control over an object including modifying attributes, resetting passwords, and changing the object's ACL.

Question 3

What is a common Active Directory attack technique that exploits misconfigured ACLs?

Accepted Answer

ACL abuse using overpermissioned ACEs like WriteDACL or GenericAll to escalate privileges

Answer

ACL abuse exploits overly permissive ACEs (such as WriteDACL, GenericWrite, or GenericAll) to escalate privileges or take control of accounts in Active Directory.

Question 4

What does the 'WriteDACL' permission allow an attacker to do in Active Directory?

Accepted Answer

Modify the DACL of an object to grant themselves additional permissions

Answer

WriteDACL allows a principal to modify an object's DACL, enabling an attacker to grant themselves additional rights such as Full Control over that object.

Question 5

In OpenLDAP ACL syntax, what does the 'by' clause specify?

Accepted Answer

Who the access rule applies to, such as specific users, authenticated users, or anonymous connections

Answer

The 'by' clause in an OpenLDAP ACL defines who the permission applies to, supporting specifiers like `users`, `anonymous`, `self`, or specific DNs.

(ACL) Access Control Lists Practice Test

(ACL) Access Control Lists Practice Test

ACL ACL in Active Directory & LDAP 2