unsigned-sh0rt.netwriteupWriteAccountRestrictions (WAR) – What is it good for?
Deep-dive AD research showing that the WriteAccountRestrictions (WAR) property set — which grants control over msDS-AllowedToActOnBehalfOfOtherIdentity and UserAccountControl — is commonly delegated to domain-join service accounts because Microsoft's own domain-join permission guidance recommends it, not because of staging misconfigurations as previously assumed. The author, working from BloodHound Enterprise/Scentry assessment findings and BloodHound 8.0's new ACL-inheritance tracking, builds three concrete attack paths: resurrecting a disabled computer account via UAC manipulation + password reset + krbrelayx to capture unconstrained-delegation TGTs, a full Zerologon-style DC password-zero/DCSync/restore chain automated in a released PoC tool (SetZeroSync), and RBCD abuse against user-configured service accounts (e.g., SCCM site server) to pivot into the SCCM SQL database. It closes with defensive guidance on auditing broad WAR delegations, staging OUs, and graveyard OUs for disabled accounts.
Offensive Security, Identity & Access· 2025-10-01T16:43:31+00:00