WriteAccountRestrictions (WAR) – What is it good for?
specterops.io | blog
Summary
TL;DR - The User-Account-Restrictions property grants read/write permissions to the user-account-control LDAP attribute, which can be used to manipulate account and security settings. Delegating write permissions for the property set is also typically combined with “force password reset” for domain join operations. If misconfigured, the principal with these permissions could, at a minimum, compromise accounts or, at worst, compromise the domain.
- Published
- Collected
--- id: 9491 title: "WriteAccountRestrictions (WAR) – What is it good for?" source_domain: specterops.io source_url: "https://specterops.io/blog/2025/10/01/writeaccountrestrictions-war-what-is-it-good-for/" published_at: "2025-10-01T17:11:15Z" phying_url: "https://phying.com/item/9491" lang: en --- # WriteAccountRestrictions (WAR) – What is it good for? ## Summary TL;DR - The User-Account-Restrictions property grants read/write permissions to the user-account-control LDAP attribute, which can be used to manipulate account and security settings. Delegating write permissions for the property set is also typically combined with “force password reset” for domain join operations. If misconfigured, the principal with these permissions could, at a minimum, compromise accounts or, at worst, compromise the domain. ## Intelligence Metadata - **Sources:** specterops.io - **Published:** 2025-10-01T17:11:15Z - **Original:** https://specterops.io/blog/2025/10/01/writeaccountrestrictions-war-what-is-it-good-for/ - **Phying News:** https://phying.com/item/9491