Computer Account Restriction Modification

On an Active Directory computer object, effective rights must match the selected attribute. Writing msDS-KeyCredentialLink enables the shadow-credential path; the BloodHound WriteAccountRestrictions relationship represents write access in the User-Account-Restrictions property set, including msDS-AllowedToActOnBehalfOfOtherIdentity for RBCD, and does not imply Key Credential write access. GenericAll and GenericWrite may cover multiple attributes, while WriteDACL or WriteOwner can require separate ACL or ownership changes before an attribute is writable. These are alternative paths with distinct prerequisites and outcomes; their labels alone do not prove authentication or service access.