Owner
Owner
Summary
FSProtect ACL Alias
Owner
AD Alias
Owner
Affected Object Types
All Objects
Exploitation Certainty
Certain
Description
The Owner permission in Active Directory identifies who owns an object, such as a user account, group, or organizational unit. Ownership is critical because it grants implicit rights to modify the object's permissions and Access Control Lists (ACLs), enabling administrators to delegate control and manage security effectively. Technically, the Owner permission effectively provides GenericAll + WriteDACL access, giving full control over the object’s security settings.
However, if misconfigured, the Owner permission can introduce significant security vulnerabilities. An attacker who becomes the Owner of an object can modify its permissions to grant themselves elevated rights like Full Control. This allows them to alter or delete the object, change group memberships, reset passwords, and manipulate user accounts. Exploiting this vulnerability can lead to unauthorized access, privilege escalation, and persistent control over critical directory objects, potentially compromising the entire Active Directory environment.
Identification
PowerShell
Active Directory Module
Using the ActiveDirectory PowerShell module, you can view the Owner of a given AD object.
Function: Get-ADObjectOwner
function Find-ADObjectOwner {
[CmdletBinding()]
param([string]$Target,[string]$SearchBase, [string]$OutputPath = "ADObjectOwner.csv")
Import-Module ActiveDirectory -ErrorAction Stop
try {
$baseDN = if ($SearchBase) { $SearchBase } else { (Get-ADRootDSE).defaultNamingContext }
if ($Target) {
try {
$objects = @( Get-ADObject -Identity $Target -Properties name,objectClass,distinguishedName )
} catch {
Write-Error "Target '$Target' not found or inaccessible: $($_.Exception.Message)"
return
}
} else {
Write-Host ("Enumerating objects under '{0}'..." -f $baseDN)
$objects = Get-ADObject -SearchBase $baseDN -LDAPFilter "(objectClass=*)" -ResultSetSize $null -Properties name,objectClass,distinguishedName
}
if (-not $objects) {
Write-Output "No objects found."
return
}
$i = 0
$total = $objects.Count
$results = foreach ($obj in $objects) {
$i++
if ($total -gt 1) {
Write-Progress -Activity "Reading owners" -Status "$i / $total : $($obj.DistinguishedName)" -PercentComplete (($i / $total) * 100)
}
try {
$acl = Get-Acl "AD:$($obj.DistinguishedName)"
$ownerRaw = $acl.Owner
$ownerName = $null
$ownerSid = $null
try {
if ($ownerRaw -match '^S-1-') {
$sid = New-Object System.Security.Principal.SecurityIdentifier($ownerRaw)
$ownerSid = $sid.Value
$ownerName = ($sid.Translate([System.Security.Principal.NTAccount])).Value
} else {
$ownerName = $ownerRaw
$nt = New-Object System.Security.Principal.NTAccount($ownerRaw)
$ownerSid = ($nt.Translate([System.Security.Principal.SecurityIdentifier])).Value
}
} catch {
$ownerName = $ownerRaw
$ownerSid = $ownerRaw
}
[PSCustomObject]@{
Name = $obj.Name
ObjectClass = ($obj.ObjectClass -join ';')
ObjectDN = $obj.DistinguishedName
Owner = $ownerName
OwnerSID = $ownerSid
}
} catch {
Write-Warning "Failed to read ACL for '$($obj.DistinguishedName)': $($_.Exception.Message)"
[PSCustomObject]@{
Name = $obj.Name
ObjectClass = ($obj.ObjectClass -join ';')
ObjectDN = $obj.DistinguishedName
Owner = $null
OwnerSID = $null
}
}
}
if ($OutputPath) {
$results | Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8
Write-Host "Owner information exported to '$OutputPath'"
} else {
return $results
}
} catch { Write-Error "Unhandled error: $($_.Exception.Message)"}
}Usage Examples:
1. Get all domain objects owners and export to CSV
Find-ADObjectOwner2. Get owner of a specific AD object and export to CSV
Find-ADObjectOwner -Target "CN=Distributed COM Users,CN=Builtin,DC=Forestall,DC=labs"#. Using Searchbase to limit the search scope
Find-ADObjectOwner -SearchBase "CN=Builtin,DC=Forestall,DC=labs"Active Directory Users and Computers (ADUC)
1. Open Active Directory Users and Computers on your Windows Server.
2. Right-click on the Object name.
3. Select Properties from the context menu.
4. Go to the Security tab.
5. Click Advanced to open Advanced Security Settings.
6. The Owner is displayed at the top of the window
Exploitation
The Owner permission grants full control over an object's DACL. Exploitation consists of modifying ACLs of objects you own, without performing unrelated actions like password resets. Below are example scenarios.
User
As the Owner of a user object, you can always change its DACL and ownership, effectively deciding who may reset the password, modify sensitive attributes like msDS-KeyCredentialLink or servicePrincipalName, and otherwise control management of the account. References: ForceChangePassword, AddKeyCredentialLink, WriteSPN
Group
As the Owner of a group, you can alter its DACL and ownership to determine who may add or remove members and change group properties, giving you ultimate authority over how membership and management rights are delegated. References: AddMember
Computer
As the Owner of a computer object, you can modify its DACL and ownership to control access to sensitive attributes and identity settings—including LAPS password attributes, key-credential links, SPNs, and delegation-related fields—thereby governing who can manage the machine account. References: LapsPassword, AddKeyCredentialLink, AddAllowedToAct
Domain Object
As the Owner of the domain head object (root of the Default Naming Context), you can change its DACL and ownership to grant or restrict powerful directory-wide rights, including replication-related permissions, effectively controlling who can read or synchronize directory data at scale. References: DCSync
GPO
As the Owner of a GPO, you control its ACLs and thus who may read or edit policy settings in the AD GPC and the corresponding SYSVOL GPT; any changes you authorize will flow to targeted users and computers through standard Group Policy processing. References: GPOWrite
Certificate Template
As the Owner of a certificate template, you can change its permissions and configuration to decide who may read, enroll, autoenroll, or manage the template; because these settings govern issuance and identity assertions, ownership directly shapes the security boundary of AD CS. References: WriteCertificateTemplates
Delegated Managed Service Account
If an attacker has Owner permissions over a dMSA object, they can modify the object’s DACL to grant themselves FullControl. With this access, they can update the PrincipalsAllowedToRetrieveManagedPassword property to include their own account, allowing them to retrieve the managed service account’s password.
Example:
Set-ADServiceAccount -Identity MyAppSvc -PrincipalsAllowedToRetrieveManagedPassword adamOnce added, the attacker can read the password. For more abuse details, see the ReadGMSAPassword edge.
Mitigation
With this method, you can check the owner of an object, verify the current owner, and update the owner if needed.
1. Open Active Directory Users and Computers (ADUC).
2. Enable Advanced Features from the View menu.
3. Navigate to the object (user, group, or OU) with dangerous Owner permissions.
4. Right-click the object and select Properties.
5. Go to the Security tab and click Advanced.
6. Check the Owner field at the top. If it is set to an unauthorized user, click Change to set the owner to a controlled group (Such as Domain Admins)
Detection
Adding new Access Control Entries on the Active Directory objects changes the ntSecurityDescriptor attribute of the objects themselves. These changes can be detected with the 5136 and 4662 Event ID's to identify dangerous modifications.
5136
A directory service object was modified.
ntSecurityDescriptor
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
4662
An operation was performed on an object.
AccessList, AccessMask
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662
References
Last updated
Was this helpful?