Active Directory Password Reset via Delegated ACE

An adversary may abuse effective permissions on an Active Directory user object to set a new password without knowing the old one. The LDAP reset operation requires the User-Force-Change-Password control access right; broader effective control such as GenericAll may also include the required right. WriteDACL or WriteOwner alone does not authorize the reset, although either may be used in a separate ACL-escalation step to grant reset rights. The operator learns the newly chosen password; the procedure does not recover the previous password. Resetting another account can disrupt its owner's access and is audited when account-management auditing is enabled.