ADACL-012: Non-Default Domain Root Permissions
- Platform
- Active Directory
- Category
- AD ACL & Delegation
- Severity
- High
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Guerrilla reads the ntSecurityDescriptor attribute on the domain root object (the distinguishedName DC=<domain>,DC=<tld>) using the OWNER_SECURITY_INFORMATION, DACL_SECURITY_INFORMATION, and SACL_SECURITY_INFORMATION control flags. Each ACE in the DACL is normalised (Trustee SID, AccessMask, ObjectType GUID, InheritedObjectType GUID, AceFlags) and compared against the default ACL shipped by Microsoft for the forest functional level in use (Windows Server 2016, 2019, 2022, 2025). ACEs that are not part of the baseline are reported with: trustee resolution, the rights granted (GenericAll, WriteDacl, WriteOwner, WriteProperty, Self, Extended-Right including DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), the ObjectType GUID where applicable, and the inheritance scope. The owner of the object is also evaluated, since a non-default owner can re-write the DACL at will.
Why it matters
The domain head is the parent of every container in the directory (Users, Computers, Domain Controllers, the Configuration NC root inherits separately but related rights apply). Because the default DACL on the domain root carries the CONTAINER_INHERIT_ACE and OBJECT_INHERIT_ACE flags on most ACEs, a write granted at the head is effectively a write everywhere unless explicitly blocked by an "Include inheritable permissions from this object" toggle further down. A single GenericAll, WriteDacl, or WriteOwner ACE granted to a compromised user, an over-delegated helpdesk group, or a stale service account converts that principal into a domain compromise primitive: the trustee can grant themselves DS-Replication-Get-Changes-All (DCSync), reset KRBTGT, modify the AdminSDHolder template, or change the owner of any privileged group. Many real-world domain takeovers begin with an inherited ACE on the domain root that nobody noticed for years.
Attack path
1. Enumeration. An attacker with any authenticated user identity runs BloodHound (SharpHound collector) or PowerView (Get-DomainObjectAcl -Identity (Get-Domain).DistinguishedName) and inspects the DACL on the domain head. BloodHound surfaces this as a GenericAll, WriteDacl, WriteOwner, GetChanges, or GetChangesAll edge from the controlled principal to the domain node. 2. Pivot selection. If WriteDacl or GenericAll is present, the attacker adds an explicit ACE that grants themselves DS-Replication-Get-Changes (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2) and DS-Replication-Get-Changes-All (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2). If WriteOwner is present, they first change the owner to themselves, then re-write the DACL. 3. DCSync. Using mimikatz lsadump::dcsync, secretsdump.py, or impacket-secretsdump, the attacker replicates the krbtgt hash and any other account of interest. 4. Golden Ticket / persistence. With the krbtgt NTLM hash, the attacker mints golden tickets for arbitrary users at arbitrary trust paths and is no longer dependent on the original ACE. 5. Alternative paths. WriteProperty on the gPLink attribute of the domain root allows linking a malicious GPO to the entire domain; WriteProperty on msDS-AllowedToActOnBehalfOfOtherIdentity at any descendant enables Resource-Based Constrained Delegation attacks; Self on the member attribute permits adding the trustee to Domain Admins indirectly via inherited ACEs.
How Guerrilla assesses it
Guerrilla binds to the domain head via LDAP (RootDSE -> defaultNamingContext), requests the ntSecurityDescriptor attribute with the appropriate SD control, and parses it with System.DirectoryServices.ActiveDirectorySecurity. The parsed ACL is diffed against an embedded reference set of default ACEs keyed by forest functional level. Findings include the trustee SID, the resolved trustee name (where resolvable), the ActiveDirectoryRights value, the ObjectType and InheritedObjectType GUIDs translated to schema attribute or class names, the InheritanceType, and whether the ACE is explicit or inherited. The check also flags any owner that is not Domain Admins, Enterprise Admins, or the built-in Administrators group, and any ACE granting the four sensitive extended rights: DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set, and Reanimate-Tombstones.
Recommended value
Only default Microsoft ACEs on the domain root; all custom ACEs documented and justified
Remediation
Compare current domain root ACL against the default ACL for your domain functional level. Document any non-default ACEs and validate their operational necessity. Remove ACEs that are no longer required or that grant excessive permissions. Pay special attention to ACEs that apply to 'This object and all descendant objects'.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6, AC-3, CM-6
- MITRE ATT&CK
- T1222.001, T1003.006