Active Directory Delegation Model Audit: How to Find Non-Standard Permissions That Grant Unexpected Control Over AD Objects

Not all delegated rights create equal risk. These are the most dangerous:

GenericAll / Full Control: Grants every possible permission on the object. Equivalent to Domain Admin for the specific object. Allows password reset, group membership modification, disabling the account, and modifying group memberships.

WriteDACL: Allows modifying the object's DACL. An attacker holding WriteDACL can grant themselves GenericAll on the object, effectively a privilege escalation step. This right alone is sufficient for complete object compromise.

WriteOwner: Allows changing the object's owner. Owners have implicit permission to modify the DACL. WriteDACL and WriteOwner are functionally equivalent paths to object control.

GenericWrite: Allows writing any non-protected attribute. On user objects: can modify servicePrincipalName (enabling targeted Kerberoasting), scriptPath (adds malicious script to run at logon), homeDirectory, and other attributes.

AllExtendedRights: Grants all extended rights on the object. On user objects, this includes the User-Force-Change-Password extended right (force password reset without knowing current password).

WriteProperty (Member): On group objects, allows adding or removing group members. A holder of this right on Domain Admins can add themselves to the group.

ResetPassword / User-Force-Change-Password: Allows resetting the account's password without knowing the current password. Dangerous for delegations scoped to privileged user OUs.

The AD PowerShell module provides Get-ACL for AD objects, but reading AD ACLs requires the AD provider:

# Import AD provider for ACL access
Import-Module ActiveDirectory

# Audit delegations on a specific OU and all child OUs
function Get-ADOUDelegations {
    param([string]$OUPath)
    
    $ous = Get-ADOrganizationalUnit -Filter * -SearchBase $OUPath -SearchScope Subtree
    
    foreach ($ou in $ous) {
        $acl = Get-Acl -Path "AD:\$($ou.DistinguishedName)"
        
        foreach ($ace in $acl.Access) {
            # Skip built-in high-privilege accounts that are expected
            if ($ace.IdentityReference -notmatch "BUILTIN\\|NT AUTHORITY\\|S-1-5-18|S-1-5-32") {
                # Flag high-risk rights
                $isHighRisk = $false
                $highRiskRights = @("GenericAll","GenericWrite","WriteDacl","WriteOwner","AllExtendedRights")
                foreach ($right in $highRiskRights) {
                    if ($ace.ActiveDirectoryRights -match $right) { $isHighRisk = $true }
                }
                
                if ($isHighRisk -or $ace.ActiveDirectoryRights -match "WriteProperty") {
                    [PSCustomObject]@{
                        OU = $ou.DistinguishedName
                        Identity = $ace.IdentityReference
                        Rights = $ace.ActiveDirectoryRights
                        InheritanceType = $ace.InheritanceType
                        ObjectType = $ace.ObjectType
                        IsInherited = $ace.IsInherited
                        AccessControlType = $ace.AccessControlType
                    }
                }
            }
        }
    }
}

# Run against your user and admin OUs
Get-ADOUDelegations -OUPath "OU=Users,DC=domain,DC=com" | 
    Where-Object {-not $_.IsInherited} |  # Focus on explicitly set ACEs first
    Sort-Object OU, Identity | 
    Export-Csv ou-delegations.csv -NoTypeInformation

The IsInherited = $false filter surfaces explicit delegations -- these are the ones that were deliberately granted and are the most likely to be non-standard.

The highest-priority delegation audit is over the OUs containing Tier 0 and Tier 1 admin accounts:

# Identify all non-admin accounts with any write permissions on admin user OUs
$adminOUs = @(
    "OU=Tier0Admins,OU=AdminAccounts,DC=domain,DC=com",
    "OU=Tier1Admins,OU=AdminAccounts,DC=domain,DC=com"
)

$expectedIdentities = @(
    "BUILTIN\Administrators",
    "NT AUTHORITY\SYSTEM",
    "NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS",
    "DOMAIN\Domain Admins",
    "DOMAIN\Enterprise Admins",
    "Creator Owner"
)

foreach ($ouDN in $adminOUs) {
    $acl = Get-Acl -Path "AD:\$ouDN"
    $unexpectedACEs = $acl.Access | Where-Object {
        ($expectedIdentities -notcontains $_.IdentityReference.ToString()) -and
        ($_.AccessControlType -eq "Allow")
    }
    
    if ($unexpectedACEs) {
        Write-Output "[!] Non-standard ACEs on $ouDN:"
        $unexpectedACEs | Format-Table IdentityReference, ActiveDirectoryRights, InheritanceType
    }
}

For each unexpected ACE found:

1. Identify the current members of the identity (Get-ADGroupMember if it is a group)
2. Determine when the delegation was added and by whom (review AD audit events for the target OU using Event ID 5136 in Security log)
3. Verify whether the delegation is still operationally required
4. Remove if not required: Set-Acl -Path "AD:\$ouDN" -AclObject $modifiedACL

BloodHound automates delegation discovery across the entire domain by collecting ACLs on all objects and computing attack paths to Domain Admin:

Using BloodHound CE (Community Edition) for delegation audit:

# Collect AD data with SharpHound collector
.\SharpHound.exe --CollectionMethods ACL,Group,ObjectProps,Trusts --OutputDirectory C:\temp\bh-output

BloodHound queries for delegation-based attack paths:

// Find all principals with GenericWrite on any admin user
MATCH (n)-[:GenericWrite]->(m:User)
WHERE m.admincount = true
RETURN n.name, m.name, labels(n)

// Find all principals with WriteDACL on privileged objects
MATCH (n)-[:WriteDacl]->(m)
WHERE m.admincount = true OR m.objectid CONTAINS 'Domain Admins'
RETURN n.name, m.name, labels(n)

// Shortest path from a specific low-privilege account to Domain Admin
MATCH p=shortestPath((s:User {name:'user@domain.com'})-[*1..]->(t:Group {name:'DOMAIN ADMINS@DOMAIN.COM'}))
RETURN p

BloodHound is more comprehensive than manual ACL review for finding multi-hop paths (user A has WriteDACL on group B, group B has GenericWrite on user C who is in Domain Admins), but manual ACL review is faster for targeted audits of specific OUs.

After identifying non-standard delegations, remediation follows this sequence:

Step 1: Verify the delegation is not operationally active Check whether the delegated identity is still used. If a service account had delegation, verify the service still exists. Check the last login date for any users in a delegated group.

Step 2: Remove the ACE with PowerShell

# Remove a specific ACE from an OU
$ouDN = "OU=Users,DC=domain,DC=com"
$targetIdentity = "DOMAIN\old-helpdesk-group"

$path = "AD:\$ouDN"
$acl = Get-Acl $path

# Filter out the specific ACE to remove
$aceToRemove = $acl.Access | Where-Object {
    $_.IdentityReference.ToString() -eq $targetIdentity
}

foreach ($ace in $aceToRemove) {
    $acl.RemoveAccessRule($ace) | Out-Null
}

Set-Acl -Path $path -AclObject $acl
Write-Output "Removed $($aceToRemove.Count) ACE(s) for $targetIdentity on $ouDN"

Step 3: Verify with BloodHound re-collection Re-collect AD data with SharpHound after remediation and re-run the attack path queries to confirm the path is gone.

Step 4: Establish a delegation register Document all intended delegations in a configuration management database or a simple CSV that is reviewed annually. Include: OU path, delegated identity, rights granted, business justification, approval ticket, and review date. Any delegation not in the register is a finding.