userAccountControl is a numeric flag field that controls account behavior. In engagements we query it for roastable accounts, disabled accounts, delegation, password policy weaknesses, and account state changes.
export DC=10.10.10.200
export BASE='DC=ootw,DC=local'
export DOMAIN=ootw.local
export USER='student'
export PASS='student'
Important matching rule OIDs:
1.2.840.113556.1.4.803 LDAP_MATCHING_RULE_BIT_AND
1.2.840.113556.1.4.804 LDAP_MATCHING_RULE_BIT_OR
1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN
Useful flag values:
2 ACCOUNTDISABLE
512 NORMAL_ACCOUNT
8192 SERVER_TRUST_ACCOUNT
65536 DONT_EXPIRE_PASSWORD
524288 TRUSTED_FOR_DELEGATION
4194304 DONT_REQUIRE_PREAUTH
16777216 TRUSTED_TO_AUTH_FOR_DELEGATION
Find disabled users.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=2))' sAMAccountName userAccountControl
Find users whose passwords never expire.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=65536))' sAMAccountName userAccountControl memberOf
Find enabled AS-REP roastable users.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))' sAMAccountName userAccountControl
Find computers trusted for unconstrained delegation.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(samAccountType=805306369)(userAccountControl:1.2.840.113556.1.4.803:=524288))' sAMAccountName dNSHostName userAccountControl
Find domain controllers by SERVER_TRUST_ACCOUNT.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))' name dNSHostName userAccountControl
Compute a new UAC value by setting a bit.
OLD=66048
MASK=4194304
NEW=$(( OLD | MASK ))
echo $NEW
Compute a new UAC value by clearing a bit.
OLD=4259840
MASK=4194304
NEW=$(( OLD & ~MASK ))
echo $NEW
Toggle a UAC bit from PowerShell.
$u = Get-ADUser svc_web -Properties userAccountControl
$new = $u.userAccountControl -bor 0x00400000
Set-ADUser svc_web -Replace @{userAccountControl=$new}
Replace userAccountControl through LDIF after calculating the new value.
dn: CN=svc_web,OU=Service Accounts,OU=OOTW Lab,DC=ootw,DC=local
changetype: modify
replace: userAccountControl
userAccountControl: 4260352
LDAPTLS_REQCERT=never ldapmodify -H ldaps://$DC:636 -D "$DOMAIN\\$USER" -w "$PASS" -f change.ldif