Active Directory Group ACL Abuse

This record preserves bloodyAD examples for separate Active Directory rights-change paths: add a controlled account to a group, grant GenericAll on an object, assign DCSync replication rights on a domain, or configure resource-based constrained delegation (RBCD) for a computer. StandIn.exe also supports related group and ACL changes, but its syntax is not shown in these steps. These are alternative actions, not a required sequence; each requires effective write rights on the specific group, object, domain naming context, or delegation attribute and network reachability to a domain controller. Assigning DCSync rights changes authorization; retrieving credential data is a separate procedure.