Home > Security Model > Active Directory Effective Permissions
Active Directory Effective Permissions
Active Directory Effective Permissions are the actual resulting set of permissions that a user is effectively allowed on an Active Directory object, based on an accurate consideration of the collective impact of all the security permissions specified in the access control list (ACL) of an Active Directory object. They govern and control exactly who is allowed what access to every object in Active Directory i.e. to all domain user accounts, computer accounts, security groups, OUs etc. in Active Directory.
Active Directory Effective Permissions
The entire contents of Active Directory, i.e. every single domain user account, computer account, security group, OU etc. is represented as a securable object in Active Directory, and is secured by an access control list (ACL) that specifies who has what security permissions on the object.
There exist many security permissions in the ACL of each Active Directory object, and each permission allows or denies, explicitly or via inheritance, certain generic or specific access rights to a specific user, computer, security group or FSP.
The access allowed in one permission to a specific account or group could simultaneously also be denied to the same account or group in another permission in the ACL, either directly or via group memberships, explicitly or via inheritance.
What ultimately determines the acutal access that an account has on an Active Directory object are the resulting set of permissions the user is actually granted i.e. effectively allowed, on the object, in light of accurately considering the collective impact of all the security permissions specified in the ACL of that Active Directory object.
This actual resulting set of permissions on an Active Directory object are called Active Directory Effective Permissions.
An Example of Active Directory Effective Permissions
Active Directory Effective Permissions are perhaps best understood by considering a simple example, as illustrated below.
Consider a domain user account, whose ACL is configured exactly as follows -
Explicit Deny Authenticated Users All Extended Rights
Explicit Allow John Smith Reset Password
Explicit Allow Authenticated Users Read All Properties, Read Control, List Child
Explicit Allow Administrator Full Control
Based on the ACL above, can John Smith reset the password of this account?
If an IT admin were to perform simple Active Directory Permissons Analysis, he/she would errantly conclude that since there is a permission granting John Smith the Reset Password extended right on the object, John Smith can reset the password of this account.
However, if he/she were to perform Active Directory Effective Permissons Analysis, he/she would correctly conclude that although there is a permission granting John Smith the Reset Password extended right on this user account, there is also a permission denying Authenticated Users all extended rights on the account, and since John Smith is also an authenticated user, the explicit deny permission will override the explicit allow, and thus in reality, John Smith cannot actually reset the password of this acccount.
This simple example shows us that it is not determining "who has what Active Directory permissions" but in fact determining "who has what Active Directory effective permissions" that is important, and in fact essential for accurately securing Active Directory contents.
A Second Example of Active Directory Effective Permissions
Active Directory Effective Permissions also come into play even when there are no Deny permissions, as illustrated below.
Consider a domain user account, whose ACL is configured exactly as follows -
Explicit Allow John Smith Write Property - userAccountControl (bf967a68-0de6-11d0-a285-00aa003049e2)
Explicit Allow Authenticated Users Read All Properties, Read Control, List Child
Explicit Allow Administrator Full Control
Explicit Allow IT Help Desk Write All Properties
Explicit Allow IT Support Team Write Property - User-Account-Restrictions (4c164200-20c0-11d0-a768-00aa006e0529)
Based on the ACL above, can only John Smith disable this account, or can someone else also do so?
If an IT admin were to perform simple Active Directory Permissons Analysis, he/she would errantly conclude that since the only permission on the object that mentions userAccountControl is granted to John Smith, only John Smith can disable this account.
However, if he/she were to perform Active Directory Effective Permissons Analysis, he/she would correctly conclude that in addition to the permission granting John Smith Write Property to the userAccountControl attribute, there are also permissions granting Administrator Full Control, IT Help Desk Write All properties, and IT Support Team Write Property to the User-Account-Restrictions property set (of which userAccountControl is a member) in the ACL, all of which also impact the ability to modify userAccountControl and as a result, in reality, all members of the Administrators, IT Help Desk and IT Support Team groups can also disable this account!
This example also shows us that it is not determining "who has what Active Directory permissions" but in fact determining "who has what Active Directory effective permissions" that is important, and in fact essential for accurately securing Active Directory contents.
A Third Example of Active Directory Effective Permissions
Active Directory Effective Permissions govern, control and determine every single access on every single object, as illustrated below.
Consider the domain root object, whose ACL is as follows -
Explicit Deny IT Contractors All Extended Rights, Modify Owner, Modify Permissions (WD), Write All Properties
Explicit Allow Authenticated Users Read All Properties, Read Control, List Child
Explicit Allow Domain Admins Full Control (FC)
Explicit Allow Cyber Security Response Team Write All Properties, Modify Permissions (WD)
Explicit Allow Exchange Servers All Extended Rights, Modify Permissions, Write All Properties
...
Based on the ACL above, how does one determine as to exactly who can change permissions protecting the domain root object?
To make that determination, one first needs to identify and consider all security permissions that Allow or Deny Modify Permissions permissions on the object, and here sixteen out of forty-nine specified security permissions meet the criteria - 1 (WD), 3 (FC), 4 (WD), 7 (WD), 9 (FC), 12 (WD), 16 (WD), 21 (FC), 24 (WD), 27 (WD), 32 (FC), 37 (WD), 39 (FC), 42 (WD), 46 (FC) {all in ...} and 49 (WD).
Having identified these permissions, one then needs to completely expand all the group memberships that they allow/deny access for, including any and all nested group memberships, resolving any and all circular group membership conflicts, dynamically expanding any FSPs that may be group members (e.g. Authenticated Users etc.) etc. and ultimately precisely resolving all Allow / Deny conflicts.
In other words, what one is really identifying is what the actual resulting Active Directory Effective Permissons are on the object.
To reiterate, every day, across the world, at thousands of organizations, hundreds of millions of access checks take place in Active Directory, and in each and every case, it is Active Directory Effective Permissions that govern, control and determine the outcome of every requested operation, whether it be a user account creation, a computer domain-join, a password reset, a group membership change, an ACL modification, linking of a GPO to an OU, delegation of administration on an OU etc.
Active Directory Effective Permissions Are Fundamental
Active Directory Effective Permissions are absolutely fundamental to and essential for securing Active Directory.
In fact, they are so fundamental to and essential for Active Directory Security that in virtually all native Microsoft tools for Active Directory management (e.g. ADUC, ADAC) there are only 3 tabs for specifying, auditing and assessing access in Active Directory, and the third one, called Effective Access, is for calculating Active Directory Effective Permissions.
Permissions
Auditing
Effective Access
As can be clearly seen in the accompanying snapshot, the description of the Effective Access tab in Microsoft tooling literally reads - "Effective Access allows you to view the effective permissions for a user, group or device account.
As evidenced by the fact that virtually all native Microsoft management tools provide this essential tab, Active Directory Effective Permissions are undoubtedly fundamental to and absolutely essential for securing Active Directory.
Active Directory Effective Permissions Are Paramount
Active Directory Effective Permissions control exactly who has what access to every single object in Active Directory.
They control exactly who can -
Create or delete an object e.g. domain user account, computer account, group, OU etc. in Active Directory
Reset the password of a domain user account in Active Directory
Disable two-factor authentication on a domain user account in Active Directory
Change the membership of a domain security group in Active Directory
Add/remove themselves to/from a domain security group in Active Directory
Modify the access control list (ACL) of an Active Directory object
Change the ownership of an Active Directory object
Link a GPO to an organizational unit (OU) or to the domain root
Create, manage, modify or severe connections to the Cloud e.g. Microsoft Azure
Modify critical Active Directory operational data e.g. replication topology, in Configuration and Schema partitions
Active Directory Effective Permissions are thus absolutely fundamental and paramount for organizational cyber security.
10 Technical Examples of how Active Directory Effective Permissions control all access in Active Directory
The following technical examples illustrate how Active Directory Effective Permissions control literally all access inside Active Directory -
Who can create an object in Active Directory is determined by who has sufficient Create Child effective permissions to be able to create objects of the target Schema class.
Who can delete an object in Active Directory is determined by who has sufficient Standard Delete (on object), Delete Child (on parent) or Delete Tree (on any ancestor) effective permissions to be able to delete the target object.
Who can reset the password of a domain user account in Active Directory is determined by who has sufficient Extended Right - Reset Password (00299570-246d-11d0-a768-00aa006e0529) effective permissions on the domain user account.
Who can disable two-factor authentication on a domain user account in Active Directory is determined by who has sufficient Write Property - userAccountControl (bf967a68-0de6-11d0-a285-00aa003049e2) effective permissions on the domain user account.
Who can change the membership of a domain security group in Active Directory is determined by who has sufficient Write Property - member (bf9679c0-0de6-11d0-a285-00aa003049e2) effective permissions on the domain security group.
Who can add/remove themselves to/from a(ny) domain security group in Active Directory is determined by who has sufficient Validated Write - Add/remove Self as Member (bf9679c0-0de6-11d0-a285-00aa003049e2) effective permissions on the domain security group.
Who can modify the access control list (ACLs) of an Active Directory object is determined by who has sufficient Modify Permissions effective permissions on the target Active Directory object.
Who can change the ownership of an(y) Active Directory object is determined by who has sufficient Modify Owner effective permissions on the target Active Directory object.
Who can replicate secrets from a domain is determined by who has sufficient Extended Right - Get Replication Changes (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2) and Extended Right - Get Replication Changes All (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2) effective permissions on the domain-root object.
Who can modify the ACL of the AdminSDHolder object in Active Directory is determined by who has sufficient Modify Permissions effective permissions on the AdminSDHolder object in the System container.
Note - Operation 7 above can additionally also be enacted by all owners of an Active Directory object. Operation 8 above can additionally also be enacted by all security principals that have the Take Ownership User Right in the domain's default Domain Controllers Policy.
These technical facts illustrate that access to every single object in Active Directory is controlled and determined by who has sufficient effective permissions in Active Directory.
3 Limitations of the Effective Access Tab in Native Tooling
Active Directory Effective Permissions are absolutely fundamental to Active Directory security. They are so fundamental to Active Directory Security that in virtually all native Microsoft tools for Active Directory management (e.g. ADUC, ADAC) there are only three tabs for specifying, auditing and assessing access in Active Directory, and one of them, the third one, called Effective Access, is for calculating Active Directory Effective Permissions, and its description literally reads -
"Effective Access allows you to view the effective permissions for a user, group or device account."
Unfortunately, the Effective Access tab in Microsoft tooling is substantially limited. Specifically -
It is not always 100% accurate and it's output is not intuitive to comprehend
It can only be used to view the effective permissions of one user/group at a time
It cannot identify which permission in the object's ACL entitles a specific user to a specific effective permission
These three substantial limitations in the Effective Access Tab in Microsoft's tooling make it difficult for organizations and IT personnel to be able to use it to accurately and sufficiently calculate Active Directory Effective Permissions.
Active Directory Effective Permissions Calculation Requirements
In regards to the determination/calculation of effective permissions in Active Directory, what IT personnel ideally and actually require is the ability to make the following determinations accurately, automatically and easily -
Who has class-specific [ Create Child | Delete Child ] effective permissions on an Active Directory object?
Who has [ Standard Delete | Delete Child | Delete Tree] effective permissions on an Active Directory object?
Who has [ Read All Properties | Write All Properties ] effective permissions on an Active Directory object?
Who has property-specific [ Read Property | Write Property ] effective permissions on an Active Directory object?
Who has [ List Child | List Object | Read Control ] effective permissions on an Active Directory object?
Who has [ Modify Owner | Modify Permissions ] effective permissions on an Active Directory object?
Who has [ Extended Right | Validated Write ] effective permissions on an Active Directory object?
Also, ideally one should also be able to identify exactly which underlying security permission (ACE) in the ACL of the Active Directory object is entitling a specific account to a specific effective permission on the Active Directory object.
How to calculate Active Directory Effective Permissions
There are 3 options for determining (calculating) effective permissions in Active Directory -
-
Use native Microsoft Tooling
All native Active Directory management tools, e.g. Active Directory Administrative Center, Active Directory Users and Computers etc. have a tab (accessible via the Security tab,) called Effective Access for the purpose of calculating effective permissions on Active Directory objects.
In theory, one can use this tab to view effective permissions that a specific user is granted on an Active Directory object. However, in practice, as described above, its use is unfortunately substantially limited as it has a few practical shortcomings, notably - i) it is not always 100% accurate, ii) it can only be used to view the effective permissions of one user at a time, iii) it's output is not very intuitive to comprehend, and iv) it cannot identify or pinpoint which permission in the object's ACL entitles a specific user to a specific effective permission on the object.
-
Manual calculation
One can manually determine effective permissions on Active Directory objects.
To do so, one needs to gain sufficient subject matter expertise and experience, then make these calculations manually (e.g. using PowerShell), taking into careful consideration all factors that influence access in Active Directory, notably its security model, ACLs, inheritance of permissions, precedence order, conflicting permissions (Allow vs Deny), group membership expansions and nesting, circular membership loop detection etc. without making a single mistake.
Use Professional Tooling
Professional automated tooling, known as an "Active Directory Effective Permissions Calculator" can be used to make these determinations.
This is the quickest, most efficient, sufficient and above all most trustworthy option to calculate effective permissions on Active Directory objects.
In this regard, today the world's only true, accurate and Microsoft-endorsed Active Directory Effective Permissions Calculator is Gold Finger.