> For the complete documentation index, see [llms.txt](https://rabakuku.gitbook.io/ad-red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rabakuku.gitbook.io/ad-red-team/i.-active-directory-enumeration/acl-domain-enumeration.md).

# ACL Domain Enumeration

Access Control List (ACL)

 • It is a list of Access Control Entries (ACE) – ACE corresponds to individual permission or audits access. Who has permission and what can be done on an object? 

• Two types: 

– DACL – Defines the permissions trustees (a user or group) have on an object. 

– SACL – Logs success and failure audit messages when an object is accessed. 

• ACLs are vital to security architecture of AD.

## PowerView

```c
#Get the ACLs associated with the specified object
Get-ObjectAcl -SamAccountName student1 –ResolveGUIDs


#Get the ACLs associated with the specified prefix to be used for search
Get-ObjectAcl -ADSprefix 'CN=Administrator,CN=Users' -Verbose


#Get the ACLs associated with the specified LDAP path to be used for search
Get-ObjectAcl -ADSpath "LDAP://CN=Domain Admins,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local" -ResolveGUIDs -Verbose


#Search for interesting ACEs
Invoke-ACLScanner -ResolveGUIDs


#check  for rights/permissions for the RDPUsers Group
Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentityReference -match "RDPUsers"}


#Get the ACLs associated with the specified path
Get-PathAcl -Path "\\dcorp-dc.dollarcorp.moneycorp.local\sysvol"


```

## PowerShellADModule

```c
#We can also enumerate ACLs using ActiveDirectory module but without resolving GUIDs
(Get-Acl 'AD:\CN=Administrator,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local').Access
```