Enumerate Active Directory Object ACLs

Enumerate an Active Directory object's DACL/security descriptor to identify trustees and rights such as GenericAll, WriteDACL, WriteOwner, ForceChangePassword, and AddSelf that may support privilege escalation or lateral movement. Treat findings as leads: validate the target object, inheritance, group membership, and effective access before concluding a right is exploitable.