---
id: 9491
title: "WriteAccountRestrictions (WAR) – What is it good for?"
source_domain: specterops.io
source_url: "https://specterops.io/blog/2025/10/01/writeaccountrestrictions-war-what-is-it-good-for/"
published_at: "2025-10-01T17:11:15Z"
phying_url: "https://phying.com/item/9491"
lang: en
---

# WriteAccountRestrictions (WAR) – What is it good for?

## Summary

TL;DR - The User-Account-Restrictions property grants read/write permissions to the user-account-control LDAP attribute, which can be used to manipulate account and security settings. Delegating write permissions for the property set is also typically combined with “force password reset” for domain join operations. If misconfigured, the principal with these permissions could, at a minimum, compromise accounts or, at worst, compromise the domain.

## Intelligence Metadata

- **Sources:** specterops.io
- **Published:** 2025-10-01T17:11:15Z
- **Original:** https://specterops.io/blog/2025/10/01/writeaccountrestrictions-war-what-is-it-good-for/
- **Phying News:** https://phying.com/item/9491