CreateAny

Copy page

Summary


Forestall ACL Alias	CreateAny
AD Alias	Create all child objects
Affected Object Types	OUs, Domains, Containers
Exploitation Certainty	Certain
AD Right	CreateChild
AD Permission Guid	00000000-0000-0000-0000-000000000000

Description

The CreateAny permission in Active Directory allows an account to create any type of child object within a designated container. This includes users, groups, computers, and Organizational Units (OUs). When properly configured, this permission facilitates efficient administrative operations, enabling swift organizational adjustments, such as onboarding new personnel, forming temporary groups for specific projects, or restructuring directory hierarchies to meet evolving business needs.

However, if misconfigured or obtained by unauthorized principals, the CreateAny permission introduces severe security risks. An attacker can create arbitrary objects—users, groups, computers, and nested OUs—altering the directory structure to hide malicious accounts, bypass monitoring controls, and facilitate lateral movement. These unauthorized modifications may result in privilege escalation, persistent access, and widespread compromise of the domain’s confidentiality, integrity, and availability.

Identification

PowerShell

Active Directory Module

Using the ActiveDirectory PowerShell module, you can enumerate CreateAny entries.

1. Find-CreateAny function

function Find-CreateAny {
    [CmdletBinding()]
    param ( [string]$Target = $null, [string]$SearchBase = $null, [string]$OutputPath = "CreateAny.csv", [switch]$ExcludeAdmins = $false)
    Import-Module ActiveDirectory
    Write-Host "Scanning for explicit 'CreateChild' (any object class) ACEs..."
    $AccessControlType   = [System.Security.AccessControl.AccessControlType]::Allow
    $ActiveDirectoryRights = [System.DirectoryServices.ActiveDirectoryRights]::CreateChild
    $AnyObjectGuid       = [Guid]::Empty   # 00000000-0000-0000-0000-000000000000
    $ExcludedSIDs = @()
    if ($ExcludeAdmins) {
        Write-Host "Excluding default administrative groups and built-in accounts."
        try {
            $ExcludedSIDs += (New-Object System.Security.Principal.NTAccount "NT AUTHORITY\SYSTEM").Translate([System.Security.Principal.SecurityIdentifier]);$ExcludedSIDs += (New-Object System.Security.Principal.NTAccount "NT AUTHORITY\SELF").Translate([System.Security.Principal.SecurityIdentifier])
            $ExcludedSIDs += (New-Object System.Security.Principal.NTAccount "BUILTIN\Account Operators").Translate([System.Security.Principal.SecurityIdentifier])
            $ExcludedSIDs += (New-Object System.Security.Principal.NTAccount "BUILTIN\Administrators").Translate([System.Security.Principal.SecurityIdentifier]);$ExcludedSIDs += (New-Object System.Security.Principal.NTAccount "NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS").Translate([System.Security.Principal.SecurityIdentifier])
            # CREATOR OWNER
            $ExcludedSIDs += [System.Security.Principal.SecurityIdentifier]::new("S-1-3-0")
            foreach ($g in "Domain Admins","Enterprise Admins","Schema Admins","Cert Publishers","Group Policy Creator Owners","Domain Controllers","Key Admins","Enterprise Key Admins","DnsAdmins","RAS and IAS Servers") {
                try { $ExcludedSIDs += (Get-ADGroup -Identity $g -ErrorAction Stop).SID } catch {}
            }
        } catch {
            Write-Warning "Some default admin groups could not be resolved for exclusion."
        }
    }
    $foundAcls = New-Object System.Collections.Generic.List[object]
    $objectsToScan = @()
    try {
        if ($Target) {
            Write-Host "Targeting single object: '$Target'"
            $obj = Get-ADObject -Identity $Target -Properties distinguishedName -ErrorAction Stop
            if ($obj) { $objectsToScan = @($obj) } else { Write-Output "Object '$Target' not found."; return }
        } else {
            if (-not $SearchBase) {
                $SearchBase = (Get-ADDomain).DistinguishedName
            }
            Write-Host "Querying objects under: $SearchBase"
            $objectsToScan = Get-ADObject -SearchBase $SearchBase -LDAPFilter "(|(objectClass=organizationalUnit)(objectClass=container)(objectClass=domainDNS)(objectClass=computer)(objectClass=user)(objectClass=group))" -Properties distinguishedName -ResultSetSize $null -ErrorAction Stop
        }
    } catch {
        Write-Error "Failed to retrieve AD objects: $($_.Exception.Message)"
        return
    }
    foreach ($obj in $objectsToScan) {
        $ObjectDistinguishedName = $obj.DistinguishedName
        try {
            $acl = Get-Acl -Path "AD:$ObjectDistinguishedName"
            foreach ($ace in $acl.Access) {
                if ($ace.IsInherited) { continue }
                $hasCreateChild = (($ace.ActiveDirectoryRights -band $ActiveDirectoryRights) -ne 0)
                if ($ace.AccessControlType -eq $AccessControlType -and
                    $hasCreateChild -and
                    $ace.ObjectType -eq $AnyObjectGuid) {
                    $isExcluded = $false
                    if ($ExcludeAdmins -and $ExcludedSIDs.Count -gt 0) {
                        try {
                            $aceSid = $ace.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier])
                            if ($ExcludedSIDs -contains $aceSid) { $isExcluded = $true }
                        } catch {
                            Write-Warning "Could not translate SID for $($ace.IdentityReference.Value)"
                        }
                    }
                    if (-not $isExcluded) {
                        $foundAcls.Add([PSCustomObject]@{
                            'Vulnerable Object' = $ObjectDistinguishedName
                            'Internal Threat'   = $ace.IdentityReference.Value
                        })
                    }
                }
            }
        } catch {
            Write-Warning "Could not retrieve ACL for '$ObjectDistinguishedName': $($_.Exception.Message)"
        }
    }
    if ($foundAcls.Count -gt 0) {
        try {
            $foundAcls | Sort-Object -Unique 'Vulnerable Object','Internal Threat' |
                Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8
            Write-Output "$($foundAcls.Count) Results exported to '$OutputPath'."
        } catch {
            Write-Error "Failed to export CSV: $($_.Exception.Message)"
        }
    } else {
        Write-Output ("No explicit 'CreateChild (any object class)' ACEs found" + ($(if($ExcludeAdmins){" (after exclusions)"})))
    }
}

2. Scan all OUs and containers in the domain

Find-CreateAny

3. Scan a specific object

Find-CreateAny -Target "OU=UsBranch,DC=forestall,DC=labs"

4. To exclude default admin ACLs to improve visibility

Find-CreateAny -ExcludeAdmins

.NET Directory Services

By leveraging PowerShell’s built-in .NET DirectoryServices namespace, you can enumerate CreateAny entries without relying on any external modules or dependencies.

1. Find-CreateAnySimple function

function Find-CreateAnySimple {
    [CmdletBinding()]
    param ([string]$Target = $null,[string]$OutputPath = "CreateAny.csv",[switch]$ExcludeAdmins = $false)
    $CreateAnyGuid = [guid]"00000000-0000-0000-0000-000000000000"
    $AccessControlType = [System.Security.AccessControl.AccessControlType]::Allow
    $ActiveDirectoryRights = [System.DirectoryServices.ActiveDirectoryRights]::CreateChild
    $entries = @()
    if ($Target) {
        Write-Verbose "Binding to target object: $Target"
        try {
            $entries += New-Object System.DirectoryServices.DirectoryEntry("LDAP://$Target")
        }
        catch {
            Write-Error "Could not bind to '$Target': $_"
            return
        }
    } else {
        Write-Verbose "Binding to RootDSE to enumerate all objects..."
        try {
            $root = New-Object System.DirectoryServices.DirectoryEntry("LDAP://RootDSE")
            $baseDN = $root.Properties["defaultNamingContext"][0]
            $searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]"LDAP://$baseDN")
            $searcher.Filter = "(objectClass=*)"
            $searcher.PageSize = 1000
            [void]$searcher.PropertiesToLoad.Add("distinguishedName")
            $results = $searcher.FindAll()
            foreach ($res in $results) {
                try {
                    $entries += $res.GetDirectoryEntry()
                }
                catch {
                    Write-Warning "Failed to bind to result entry: $_"
                }
            }
        }
        catch {
            Write-Error "Failed to enumerate objects: $_"
            return
        }
    }
    $ExcludedSIDs = @()
    if ($ExcludeAdmins) {
        Write-Verbose "Preparing list of excluded well-known and domain-specific admin group SIDs..."
     $wellKnownAccounts = @( "NT AUTHORITY\SYSTEM", "NT AUTHORITY\SELF", "BUILTIN\Administrators",  "BUILTIN\Account Operators", "NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS")
        foreach ($account in $wellKnownAccounts) {
            try {
                $ExcludedSIDs += (New-Object System.Security.Principal.NTAccount($account)).Translate([System.Security.Principal.SecurityIdentifier])
            }
            catch {
                Write-Warning "Failed to resolve SID for $account"
            }
        }
        $ExcludedSIDs += [System.Security.Principal.SecurityIdentifier]::new("S-1-3-0")  # Creator Owner
        $domainAdminGroups = @( "Domain Admins","Enterprise Admins", "Schema Admins","Group Policy Creator Owners","Cert Publishers","Domain Controllers", "Key Admins", "Enterprise Key Admins","DnsAdmins","RAS and IAS Servers")
        try {
            $domainContext = New-Object System.DirectoryServices.DirectoryEntry("LDAP://RootDSE")
            $defaultNamingContext = $domainContext.Properties["defaultNamingContext"][0]
            $domainDN = "LDAP://$defaultNamingContext"
            foreach ($groupName in $domainAdminGroups) {
                try {
                    $searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$domainDN)
                    $searcher.Filter = "(&(objectClass=group)(sAMAccountName=$groupName))"
                    $searcher.SearchScope = "Subtree"
                    $result = $searcher.FindOne()
                    if ($result) {
                        $group = $result.GetDirectoryEntry()
                        $sid = New-Object System.Security.Principal.SecurityIdentifier($group.Properties["objectSid"][0], 0)
                        $ExcludedSIDs += $sid
                    }
                }
                catch {
                    Write-Warning "Failed to resolve group: $groupName"
                }
            }
        }
        catch {
            Write-Warning "Could not resolve domain context for exclusion."
        }
    }
    $results = foreach ($entry in $entries) {
        $dn = $entry.Path.Replace("LDAP://", "")
        Write-Verbose "Inspecting ACL for $dn"
        try {
            $acl = $entry.ObjectSecurity
            $aces = $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])
        }
        catch {
            Write-Warning "Failed to read ACL for $dn : $_"
            continue
        }
        foreach ($ace in $aces) {
            if (
                $ace.AccessControlType -eq $AccessControlType -and
                ($ace.ActiveDirectoryRights -band $ActiveDirectoryRights) -and
                ($ace.ObjectType -eq $CreateAnyGuid) -and
                -not $ace.IsInherited
            ) {
                if ($ExcludeAdmins) {
                    try {
                        $sid = $ace.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier])
                        if ($ExcludedSIDs -contains $sid) { continue }
                    }
                    catch {
                        Write-Warning "Failed to resolve SID for exclusion check: $($_.Exception.Message)"
                        continue
                    }
                }
                $who = try {
                    $ace.IdentityReference.Translate([System.Security.Principal.NTAccount]).Value
                } catch {
                    $ace.IdentityReference.Value
                }

                [PSCustomObject]@{
                    'Vulnerable Object' = $dn
                    'Internal Threat'   = $who
                }
            }
        }
    }
    if ($results) {
        $results | Sort-Object 'Vulnerable Object', 'Internal Threat' -Unique | Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8
        Write-Host "Found $($results.Count) CreateChild ACEs. Exported to $OutputPath"
    } else {
        Write-Host "No explicit CreateChild permissions found."
    }
}

2. Scan all containers in the domain

Find-CreateAnySimple

3. Scan a specific container in the domain

Find-CreateAnySimple -Target "CN=Backup Operators,CN=Builtin,DC=forestall,DC=labs"

4. To exclude default admin ACLs to improve visibility

Find-CreateAnySimple -ExcludeAdmins

Active Directory Users and Computers

1. Open Active Directory Users and Computers on your Windows server.

2. Right-click the object name.

3. Select Properties from the context menu.

4. In the Properties window, navigate to the Security tab.

5. Click the Advanced button to open the Advanced Security Settings dialog.

6. In the Advanced Security Settings window, locate and select the relevant Access Control Entry (ACE) for the user or group you wish to configure.

7. Click Edit to modify the selected ACE.

8. In the permissions list, locate and check the option Create all child objects.

9. Click OK to save your changes and close the dialogs.

Exploitation

For exploitation details on creating user, computer and dnsNode objects, see CreateUser, CreateComputer and CreateDNSNode.

Mitigation

Dangerous Access Control Entries should be removed by following the steps below.

1. Open Active Directory Users and Computers, and activate Advanced Features option.

2. Double-click the affected object and open the Security tab.

3. In this tab, click the Advanced button and open the suspicious Access Control Entry.

4. Remove the rights marked as dangerous.

5. Click OK and Apply to save the changes.

Detection

Adding new Access Control Entries to Active Directory objects modifies the ntSecurityDescriptor attribute of those objects. These changes can be detected with Event IDs 5136 and 4662 to identify suspicious modifications.

Event ID	Category	Description	Fields/Attributes	References
5136	Audit Directory Service Changes	A directory service object was modified.	ntSecurityDescriptor	https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136\|
4662	Audit Directory Service Access	An operation was performed on an object.	AccessList, AccessMask	https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662\|
4724	An attempt was made to reset an account’s password.	Subject, TargetAccount	https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4724\|
4722	A user account was enabled.	Subject, TargetAccount	https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4722\|
5137	A directory service object was created.	ObjectDN, ObjectClass	https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5137\|
4720	A user account was created.	Subject, NewAccountName	https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720\|
4741	A computer account was created.	Subject, TargetAccount	https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4741\|
4727	A security-enabled global group was created.	Subject, GroupName	https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4727\|
4731	A security-enabled local group was created.	Subject, GroupName	https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4731\|
4754	A security-enabled universal group was created.	Subject, GroupName	https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4754\|