To achieve that, we will use two different approaches: This local admin access allows us to run unrestricted powershell scripts however we would require the domain login to perform enumeration on the AD domain.We have a compromised local admin access on a domain joined machine.We have previously compromised a low privilege domain user with severe restrictions such as powershell execution disabled via AppLocker.Today, we are going to look at other possible options to hunt for these delegations across a network in an (semi-)automated manner via scripts. Another article which can be found here covered multiple other tools which can help in such manual analysis. This capability, if miss-configured, can become a major reason for AD compromise.Įarlier we only talked about manual analysis for finding such delegations. To summarize, Active Directory has a capability to delegate certain rights to non (domain/forest/enterprise) admin users to perform administrative tasks over a specific section of AD. Active Directory (AD) delegation is a fascinating subject, and we have previously discussed it in a blog post and later in a webinar.

Active directory ou permissions report