GenericAll
Summary
Forestall ACL Alias
GenericAll
AD Alias
Full Control
Affected Object Types
All Objects
Exploitation Certainty
Certain
AD Right
GenericAll
AD Permission Guid
00000000-0000-0000-0000-000000000000
Description
The GenericAll permission in Active Directory grants an account complete control over a specified directory object. With this permission, an account can perform any action—ranging from reading and modifying all attributes to managing security settings and delegating permissions. This level of authority is sometimes necessary in administrative scenarios that require full management rights over an object, such as transferring ownership, performing extensive configuration changes, or executing high-level system maintenance tasks.
However, if misconfigured or assigned to unauthorized users, the GenericAll permission introduces substantial security vulnerabilities. An attacker who gains this permission can manipulate critical directory objects by altering security configurations, modifying object attributes, or even deleting objects outright. Such exploitation can lead to unauthorized access, complete privilege escalation, and persistent control over essential network resources. In extreme cases, the attacker may leverage GenericAll to subvert the intended security architecture of the Active Directory environment, resulting in a widespread compromise of system integrity and trust.
Identification
PowerShell
Active Directory Module
Using the ActiveDirectory PowerShell module, you can enumerate GenericAll entries.
1. Find-GenericAll function
2. Scan all domain objects
3. Scan a specific object
4. To exclude default admin ACLs to improve visibility
5. Using SearchBase to limit the scope
.NET Directory Services
By leveraging PowerShell’s built-in .NET DirectoryServices namespace, you can enumerate GenericAll entries without relying on any external modules or dependencies.
1. Find-GenericAllSimple function
2. Scan all domain objects
3. Scan a specific object
4. To exclude default admin ACLs to improve visibility
Active Directory Users and Computers
1. Open Active Directory Users and Computers on your Windows server.
2. Right-click on the Object name.
3. Select Properties from the context menu.
4. In the Properties window, navigate to the Security tab.
5. In the Security Settings window, locate and select the relevant Access Control Entry (ACE) for the user or group you wish to configure.
6. In the permissions list, locate and check the option Full control.
7. Click OK to save your changes and close the dialogs.
Exploitation
User
You can reset a user’s password to gain full control over the user object—see the ForceChangePassword edge for complete abuse details. You can write to the AddKeyCredentialLink attribute on a user, enabling an attacker to create Shadow Credentials and authenticate as that principal via Kerberos PKINIT—see the AddKeyCredentialLink edge. Alternatively, you can write to the “servicePrincipalNames” attribute to perform a targeted kerberoasting attack—see the abuse section under the WriteSPN edge for more information.
Group
You can take full control of a group to directly modify its membership. See the Abuse Information section under the AddMember edge for complete abuse details. To add only yourself to the group via the narrower self-membership right, see the SelfMembership edge.
Computer
You can read a computer object’s LAPS password—see the LapsPassword edge for details. Where Windows LAPS (v2) is deployed, the password is stored in newer attributes; see the ReadLAPSv2Password and SyncLAPSPassword edges. You can write to the AddKeyCredentialLinkattribute on a computer, enabling an attacker to create Shadow Credentials and authenticate as the computer via Kerberos PKINIT—see the AddKeyCredentialLink edge for more information. You can take full control of a computer object to perform a Resource-Based Constrained Delegation attack—see the AddAllowedToAct edge for more information.
Domain Object
You can take full control of the domain object (the head object of the Default Naming Context) to grant DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights. See the DCSync edge documentation for abuse details.
Organizational Unit
You can take full control of an organizational unit, domain, or site to link or unlink Group Policy Objects via the gPLink attribute, affecting every user and computer within that scope. See the ManageGPLink edge documentation for abuse details. For how linked GPOs map to OUs, see the GPLINK edge.
Container / Object Creation
GenericAll over an organizational unit or container also includes the CreateChild right, letting an attacker create new objects (users, computers, DNS records) within that scope as a persistence or escalation primitive. See the CreateAny edge documentation, and the CreateUser, CreateComputer, and CreateDNSNode edges for specific creation chains.
GPO
You can take full control of a GPO to modify its settings, which will then apply to its targeted users and computers. Select the target object, open the gpedit GUI, and inject a malicious policy—such as an immediate scheduled task with item‑level targeting—into the GPO. Wait at least two hours for the Group Policy Client to retrieve and execute the new policy. See the GPOWrite edge documentation for abuse details.
Certificate Template
When an attacker has GenericAll permissions over a Certificate Template, they can modify its settings to introduce the ESC1 vulnerability. This misconfiguration can then be exploited to escalate privileges and ultimately gain Domain Admin rights.
For more details, see WriteOverCertificateTemplate.
Delegated Managed Service Account
If an attacker has GenericAll permissions over a dMSA object, they can modify the PrincipalsAllowedToRetrieveManagedPassword property to include their own account. This grants the ability to retrieve the dMSA's managed password.
Example:
Once added, the attacker can read the password using the same managed-password retrieval technique described for group Managed Service Accounts. See the ReadGMSAPassword edge for the password-read method.
Organizational Unit (OU)
When an attacker has GenericAll permissions over an Organizational Unit, they can write its gPLink attribute to link a malicious GPO to the OU, which will then apply to all users and computers within it.
For more details, see ManageGPLink and GPLINK.
Certificate Authority (CA)
When an attacker has GenericAll permissions over an Enterprise CA, they can modify its configuration to grant CA management rights such as ManageCA or ManageCertificates, introducing the ESC7 vulnerability that can be exploited to escalate privileges within AD CS.
For more details, see ManageCA and ManageCertificates.
Mitigation
Access Control Entries identified as dangerous objects should be removed by following the steps below.
1. Open Active Directory Users and Computers
2. Double-click the affected object and open the Security tab.
3. Remove the rights marked as dangerous objects.
4. Click the OK and Apply buttons to save changes.
Detection
Adding new Access Control Entries to Active Directory objects changes the ntSecurityDescriptor attribute of the objects themselves. These changes can be detected with the 5136 and 4662 Event IDs to identify dangerous object modifications.
5136
Audit Directory Service Changes
A directory service object was modified.
ntSecurityDescriptor
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
4662
Audit Directory Service Access
An operation was performed on an object.
AccessList, AccessMask
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662
References
Last updated
Was this helpful?