> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/access-rights.md).

# Access Rights

## Get Access Rights

### Get Access Rights with PowerView

#### Get-DomainObjectAcl

[Get-DomainObjectAcl](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainObjectAcl/) is part of [PowerSploit/PowerView](https://powersploit.readthedocs.io/en/latest/Recon/#powerview). It has an alias called `Get-ObjectAcl`.

Import the module

```powershell
powershell -ep bypass
Import-Module .\PowerView.ps1
```

**Access from current user**

To list all objects that the **current user** have higher [access rights](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectoryrights?view=netframework-4.7.2) than `ReadProperty` to

```powershell
Get-DomainObjectAcl | ? {$_.ActiveDirectoryRights -ne "ReadProperty" -and $_.SecurityIdentifier -eq (whoami.exe | ConvertTo-SID)} | Format-Table ObjectDN, ActiveDirectoryRights
```

**Note** that this approach doesn't check for any access the groups the user belongs to have!

**Access on specific object**

To list all objects (users and groups) that have maximum (i.e. `GenericAll`) [access rights](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectoryrights?view=netframework-4.7.2) on the `Management Deparment` group

```powershell
Get-DomainObjectAcl -Identity "Management Department" | ? {$_.ActiveDirectoryRights -eq "GenericAll"} | Format-Table @{N='Object';E={($_.SecurityIdentifier | Convert-SidToName)}}, SecurityIdentifier, ActiveDirectoryRights
```

SIDs are converted with object names with Convert-SidToName, an alias for [ConvertFrom-SID](https://powersploit.readthedocs.io/en/latest/Recon/ConvertFrom-SID/).

<details>

<summary>Example run</summary>

```powershell
PS C:\Tools> Get-DomainObjectAcl -Identity "Management Department" | ? {$_.ActiveDirectoryRights -eq "GenericAll"} | Format-Table @{N='Object';E={($_.SecurityIdentifier | Convert-SidToName)}}, SecurityIdentifier, ActiveDirectoryRights

Object                    SecurityIdentifier                            ActiveDirectoryRights
------                    ------------------                            ---------------------
CORP\Domain Admins        S-1-5-21-1987370270-658905905-1781884369-512             GenericAll
CORP\stephanie            S-1-5-21-1987370270-658905905-1781884369-1104            GenericAll
BUILTIN\Account Operators S-1-5-32-548                                             GenericAll
Local System              S-1-5-18                                                 GenericAll
CORP\Enterprise Admins    S-1-5-21-1987370270-658905905-1781884369-519             GenericAll

```

</details>

## Resources

**Get-DomainObjectAcl** - PowerSploit Docs: <https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainObjectAcl/>