Active Directory Permission Coverage Expansion

Overview

Every permission an identity holds in Active Directory is a possible attack path. During each sync, GraphnAI reads your domain's access control lists and object attributes, and turns each grant into an edge in the identity graph. The more of them it maps, the closer the graph is to your real attack surface.

This guide covers these permission types:

1. DCSync replication rights. GraphnAI tracks all three replication rights, including GetChangesInFilteredSet.
2. Kerberos delegation. Constrained delegation (AllowedToDelegate) and resource-based constrained delegation, or RBCD (AllowedToAct), come from the attributes that configure them.
3. gMSA password readers. Principals allowed to read a group Managed Service Account (gMSA) password become ReadGMSAPassword edges.
4. Property writes. WriteAccountRestrictions (write account control flags) and WriteGPLink (link a Group Policy Object to an OU) are separate, named permissions.
5. Self-enrollment. AddSelf (add yourself to a group) is kept apart from AddMember (add anyone to a group).

There's nothing to configure. After a full sync, these edges appear in the graph and in every analysis view.

---

Prerequisites

• Role: Admin to start a sync. Viewer or Operator to explore the results.
• Active Directory bridge: An Identity Bridge connected to your domain, configured and reachable.
• Full sync: A delta sync rebuilds edges only for objects that changed. Run a full sync to see these types for every object.

---

What Gets Detected and Why It Matters

GetChangesInFilteredSet: Supplementary Replication Right

Permission: GetChangesInFilteredSet Severity: High Appears in: The HasPermission edge to the domain

Active Directory has three replication rights: GetChanges, GetChangesAll and GetChangesInFilteredSet. GraphnAI reads all three.

DCSync needs GetChanges and GetChangesAll. When an identity holds both on the domain, its HasPermission edge lists one permission, DCSync, in place of the replication rights. That identity can pull password hashes from a domain controller.

Without DCSync, GetChangesInFilteredSet stays listed under its own name at High severity. Together with GetChanges, it still replicates part of the directory, so review it.

WriteAccountRestrictions: Account Control Abuse

Permission: WriteAccountRestrictions Severity: High Appears in: HasPermission edges to users and computers

This permission lets an identity write another object's User-Account-Restrictions property set. The holder can:

• Enable or disable the target account.
• Set or clear Account is sensitive and cannot be delegated (the Active Directory setting's name).
• Change the Kerberos pre-authentication requirement (the DONT_REQ_PREAUTH flag), which opens the account to AS-REP Roasting.

An attacker with WriteAccountRestrictions on a privileged account can clear its delegation restrictions and then impersonate it. On a computer, the permission lets an attacker set up resource-based constrained delegation (RBCD), a known escalation technique.

WriteGPLink: Group Policy Object Linking

Permission: WriteGPLink Severity: High Appears in: HasPermission edges to OUs and the domain

An identity with WriteGPLink on an OU or the domain can change the gPLink attribute to link a Group Policy Object there. Attackers who control a GPO, or can create one, often link it to an OU that holds privileged accounts or domain controllers. It's a common way to move laterally and persist.

WriteGPLink matters most on a high-value OU, such as the one holding your domain controllers, or on the domain itself.

AddSelf: Self-Enrollment in Groups

Permission: AddSelf Severity: Medium Appears in: HasPermission edges to groups

An access control entry with the DS_SELF access mask on a group's member property lets the trustee add or remove only themselves. AddMember lets the trustee add anyone.

An identity with only AddSelf on a privileged group can join it and gain its permissions. It can't add anyone else.

When one identity holds AddSelf and another holds AddMember on the same group, the AddMember holder has wider control over the group's membership.

AllowedToDelegate: Constrained Kerberos Delegation

Edge type: AllowedToDelegate Severity: Medium Appears in: Its own edge, from an identity to each target computer

Constrained delegation lets a service account impersonate any authenticated user to a set of services (S4U2Proxy). The msDS-AllowedToDelegateTo attribute lists those services by service principal name (SPN).

GraphnAI reads this attribute and adds an AllowedToDelegate edge from the identity to each target computer. An attacker who takes over a service account with delegation to a domain controller can impersonate any domain user, including Domain Admins, to that domain controller.

AllowedToDelegate edges have the Constrained fidelity level, because GraphnAI reads the allow-list itself.

A delegation target in a domain no bridge syncs has no edge. GraphnAI can't resolve it to a computer, so it leaves it out.

AllowedToAct: Resource-Based Constrained Delegation

Edge type: AllowedToAct Severity: Medium Appears in: Its own edge, from an identity to a resource computer

Resource-based constrained delegation (RBCD) runs the other way from classic delegation. The resource lists the identities allowed to impersonate users to it, in its msDS-AllowedToActOnBehalfOfOtherIdentity attribute.

An AllowedToAct edge reads "Identity A can act on behalf of other users when it accesses Computer B." An attacker who can write that attribute on a target computer can set up RBCD for themselves. Writing it takes WriteAccountRestrictions or GenericWrite on the computer.

An unexpected AllowedToAct edge from a low-privilege identity to a sensitive server means a misconfiguration or a compromised RBCD setup.

AllowedToAct edges have the Constrained fidelity level.

ReadGMSAPassword: Theft of gMSA Credentials

Edge type: ReadGMSAPassword Severity: High Appears in: Its own edge, from each allowed reader to the gMSA

A gMSA's password rotates automatically. The msDS-GroupMSAMembership attribute on the gMSA lists the principals allowed to read the current password. Any of them can authenticate as the gMSA.

GraphnAI reads this attribute and adds a ReadGMSAPassword edge from each allowed reader to the gMSA. gMSAs often run high-privilege automation, such as backup agents or scheduled tasks, so a reader of a privileged gMSA holds a credential theft path.

ReadGMSAPassword edges have the Constrained fidelity level.

---

How to See These Permissions

Step 1: Trigger a Full Sync

A delta sync rebuilds edges only for objects that changed since the last sync. A full sync builds AllowedToDelegate, AllowedToAct and ReadGMSAPassword edges for every object.

1. Sign in as an Admin.
2. Select Bridges in the sidebar.
3. Select your Active Directory bridge.
4. Select Full sync.
5. Wait for the sync to finish. The Status changes from Syncing back to Online, and the new row in the sync history reads Success.

Step 2: Explore the Edges in the Graph

When the sync finishes, open the Graph Explorer.

To find identities with delegation:

1. Search for a service account you know has delegation set up in Active Directory.
2. Look for its Allowed to delegate edges.
3. Select one to see the target computer.

To find gMSA password readers:

1. Search for the gMSA by name.
2. Look for its incoming ReadGMSAPassword edges.
3. Each one starts at a principal that can read the gMSA's current password.

To find WriteGPLink or WriteAccountRestrictions:

1. Search for an OU or a computer.
2. Look for its incoming HasPermission edges.
3. Select one to see its permissions, and look for WriteGPLink or WriteAccountRestrictions.

Step 3: Review the Dashboard

The Risk Posture Dashboard recalculates after the sync. The high-severity permissions in this guide, and the AllowedToDelegate, AllowedToAct and ReadGMSAPassword edges, all count toward over-permission findings.

Select Dashboard in the sidebar to see the updated scores.

---

How These Permissions Are Displayed

Permissions Inside HasPermission Edges

These permissions are listed on a HasPermission edge. All the permissions one trustee holds on one target share one edge:

An edge's severity is that of its most dangerous permission. Its weight also grows with the number of permissions. An identity with both WriteGPLink and WriteAccountRestrictions on one target is a bigger risk than either alone.

Edge Types of Their Own

AllowedToDelegate, AllowedToAct and ReadGMSAPassword are edge types of their own, separate from HasPermission:

• Color by type. Allowed to delegate is teal and Allowed to act is violet.
• Fidelity border. A faint blue border marks the Constrained fidelity level.
• Different source. They come from object attributes. HasPermission comes from access control lists.

To show or hide Allowed to delegate and Allowed to act, select the funnel icon (Show or hide edge types) in the Graph Explorer toolbar. They're listed under Delegation and SID history.

Tiered Fidelity™

---

Attack Path Scenarios

These scenarios show how the permissions chain together, so you can prioritize.

Full DCSync Path

An identity whose HasPermission edge to the domain lists DCSync can extract every password hash in the domain. See GetChangesInFilteredSet for how GraphnAI builds it from the replication rights.

Treat DCSync held by an unexpected identity as a critical finding.

RBCD Privilege Escalation Chain

A common RBCD escalation runs like this:

1. An attacker takes over Identity A, which has low privilege.
2. Identity A has WriteAccountRestrictions or GenericWrite on Computer B.
3. The attacker writes msDS-AllowedToActOnBehalfOfOtherIdentity on Computer B, granting Identity A delegation rights.
4. The next sync shows an AllowedToAct edge from Identity A to Computer B.
5. The attacker impersonates a Domain Admin to Computer B with S4U2Self and S4U2Proxy.

In GraphnAI, the path is a HasPermission edge listing WriteAccountRestrictions from Identity A to Computer B. Once RBCD is set up, an AllowedToAct edge joins them.

gMSA Theft to Privileged Service

Some gMSAs run high-privilege services, such as a backup agent or a scheduled task with Domain Admin rights. Any reader of such a gMSA's password can authenticate as that service.

Look for ReadGMSAPassword edges to gMSAs that are members of privileged groups, or that hold HasPermission edges to domain controllers.

GPLink Abuse Through a Malicious GPO

An identity with WriteGPLink on an OU, and a GPO it can create or change, can push any computer configuration to every machine in that OU. Attackers aim for OUs that hold domain controllers or servers running privileged services.

---

Troubleshooting

These edges don't appear after a sync

Possible causes:

• Only a delta sync ran. A delta sync rereads only objects that changed, so it may skip delegation and gMSA attributes. Run a full sync.
• The sync hasn't finished. GraphnAI builds edges after it imports every object. On a large domain, the Build permissions phase can run for several minutes after the directory read ends. Check the sync history on the bridge's page.

Solution: Run a full sync and wait until its row reads Success before you check the graph.

AllowedToDelegate is missing for a known delegation

Possible causes:

• Cross-domain delegation. The SPN in msDS-AllowedToDelegateTo names a host in a domain no bridge syncs, so GraphnAI can't resolve the target computer.
• Unusual SPN format. An SPN GraphnAI can't parse for a host name is skipped.
• Target computer not synced yet. Without the computer in the graph, the edge has nothing to point at.

Solution:

1. Check that the target's domain is configured on a bridge, under Bridges in the sidebar.
2. Search for the target computer by its DNS host name in the search bar.
3. If the target is in another domain, add a bridge for that domain.

You see AddSelf where you expected AddMember

Cause: This is correct. Active Directory uses a different access mask, DS_SELF, for the right to add only yourself to a group. DS_WRITE_PROP allows adding anyone. GraphnAI records these as two permission types.

If a compliance report checks privileged groups for AddMember, make it check AddSelf too.

ReadGMSAPassword is missing for a gMSA

Possible causes:

• The gMSA isn't in the graph. Every sync collects gMSAs, but the sync account must be able to read the object.
• Empty reader list. A gMSA with no msDS-GroupMSAMembership value lets nobody read its password, so it has no edges.
• Reader in an unsynced domain. If a reader comes from a domain no bridge syncs, GraphnAI can't resolve its SID, so it leaves the edge out.

Solution:

1. Search for the gMSA by name. If it isn't there, check the sync account's read access to it.
2. If the gMSA is there with no incoming ReadGMSAPassword edges, check msDS-GroupMSAMembership on the object in Active Directory.
3. If the reader is in another domain, add a bridge for that domain.

Over-permission findings are higher than you expected

Cause: High-severity permissions such as WriteAccountRestrictions, WriteGPLink and ReadGMSAPassword can be widespread. Over-permission analytics counts them all.

Recommended action: Open Identity Inventory with the Over-permissioned preset and review the top findings. Use the Graph Explorer to look into the identities with the most impact. Weigh each high-severity permission in context, because not all of them are an active risk.

---

Best Practices

1. Run a full sync after setup. Schedule one in your next maintenance window so every object gets these edges.
2. Look for DCSync first. DCSync from an unexpected identity is your highest-priority finding.
3. Audit delegation. Review AllowedToDelegate and AllowedToAct edges in the Graph Explorer. Both kinds of delegation can be legitimate, and both are often misconfigured.
4. Review gMSA access. For each gMSA, check its incoming ReadGMSAPassword edges. Only the groups and computers you expect should be there.
5. Check WriteGPLink on domain controller OUs. WriteGPLink on an OU that holds domain controllers lets an attacker push configuration to your most sensitive machines.
6. Simulate before you remediate. Before you remove a delegation or a group membership, open the change in Select Fire. Its Simulate step shows which paths the change removes. See Select Fire.