Active Directory Object Ownership Takeover

Abuse WriteOwner on an Active Directory object to set the authenticated principal as owner, then choose one DACL change: grant that principal FullControl on the object or grant WriteMembers on a group. WriteMembers is a narrower group-specific alternative and does not itself add a member. The procedure ends at the permission change; subsequent DCSync configuration, group membership changes, or use of the new rights are outside this record. With WriteOwner alone, AD permits taking ownership for oneself; assigning another owner requires additional rights. Owner-derived WRITE_DAC behavior can also depend on the object's security descriptor and domain policy.