I am learning AD pentesting and I am looking for a way to enumerate the user's permissions.

Note:- Here through permissions I am talking about those permissions which are found in the security tab.

So, Is there any tool or any way to enumerate what permission do have the user? I didn't find a way to enumerate, maybe there is no way.

closed as off-topic by Greg Askew, bodgit, Ward Dec 20 '18 at 0:49

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – Greg Askew, bodgit, Ward
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    I am looking for a way to enumerate the user's permissions - What permissions? I am talking about those permissions which are found in the security tab. - Security tab of what? – joeqwerty Dec 19 '18 at 4:30
  • When we go to the properties of the user and found a security tab on those sections. Under that tab, there are a lot of permission options are there. So I am talking about those options/permission options – janu agrawal Dec 19 '18 at 7:09
  • 1
    Do you mean the access control list controlling who has access to the user object? – Harry Johnston Dec 19 '18 at 10:02
  • A user may have permissions on a file, folder, active directory object, exchange mailbox .... please edit your question – marsh-wiggle Dec 19 '18 at 14:25

To start out, the "security tab" of a user account enumerates the permissions on that account, not the permissions that the account has in the environment. Understanding this very basic principle is crucial for a person who will be charged with attempting to penetrate Active Directory and identify and understand vulnerabilities in particular implementations.

Another item that is crucial to understand is that Active Directory itself is not a central repository of permissions. That is, while there are a lot of WHOs and WHATs in Active Directory, it is not a database of WHO has access to WHAT (outside of the actual database objects themselves. While it can be used to provide this information, it requires that it be designed and managed precisely with that goal in mind, and a strict adherence to maintaintenance; however, this is not commonly the case.

As you are going to be performing penetration tests, you will likely be attempting to perform these tests in various environments whose composition, structure and organization are outside of your control, you will frequently encounter the directory that is not maintained as such.

Each resource has its own ACL. Moreover, we're not just speaking of ACLs on file shares, but also directory objects, printers, file systems, etc. These accounts can also be members of local groups (as previously mentioned), and can be delegated User Rights on member computers -- not to mention specific file system permission entries on member computers which are not otherwise directly exposed by file shares. Access to hypervisors, storage devices, switches, firewalls, and other networking gear could also be controlled by Active Directory authentication.

That does not even get into the scope of access in trusted forests, LDAP-authenticated applications (like internal web services or applications), databases, federated logons, etc.

So, essentially, the answer to your question is generally, one can't (easily) enumerate a complete list of all access granted to a particular user account, and I would argue that it is likely outside the scope of pentesting Active Directory anyway.


I can't comment, therefore I'll post it as an answer.

I think there are only two ways of doing what you want :

  • Get all the groups of the user. If you know what ACL every group is for, you'll have your list. This means you need to know the infrastrucutre already.
  • Make a script to list everything, everywhere (not only files ACL but groups present in administrators groups on a machine, etc...). This would be so complicated you would need some sort of AI I guess. Splunk maybe ? I don't really know what it's capable of.

Not the answer you're looking for? Browse other questions tagged or ask your own question.