Access in Active Directory
Technically speaking, 100% of Active Directory Security is about access, and of which, about 99% of it is all about access provisioned inside Active Directory, and to be specific, its all about actual resulting access to the entire contents of Active Directory.
After all, if a perpetrator can enact even one of the following 10 operations, its Game Over -
- Replicate secrets from Active Directory
- Modify the ACL of the domain root object
- Modify the ACL of the AdminSDHolder object
- Reset the password of an Active Directory admin account
- Modify the membership of an Active Directory administrative group
- Modify Kerberos related settings on a SAW's domain computer account
- Link a malicious GPO to any critical organizational unit (OU) in Active Directory
- Modify various settings (e.g. EKUs) on Certificate Template objects in Certificate Services
- Change a single critical permission in Active Directory Domain Services or Certificate Services
- Modify various properties (e.g. altSecurityIdentities, UPN etc.) on an Active Directory admin account
Now ask yourself this -
Question - What controls the ability of a perpetrator to do each one of the above 10 operations?
Answer - It is the collective (resultant) impact of all pertinent Active Directory Security Permissions specified in the ACLs of Active Directory objects, also known as Active Directory Effective Permissions that does so.
The keys to all access in Active Directory (including privileged access) thus lie in Active Directory Effective Permissions, which are based on Active Directory Security Permissions that come from Default Access, Admin Delegation and Access Provisioning.