SGSPECTER.GHOSTCOMMUNITY EDITION
← LABS
// GUIDED TRAINING · Active Directory

Directory Rights

Directory access control

Hard500 PTSOFFLINE SIMULATION
// 01 · LEARN

DIRECTORY ACCESS CONTROL

An Active Directory DACL contains access control entries granting principals specific rights. Delegation should follow least privilege, especially for WriteDACL and WriteOwner.

LEARNING GOAL

Identify the misconfiguration in the synthetic evidence and explain a defensive correction.

// 02 · INVESTIGATE

EVIDENCE

Object: CN=Training-Operators,OU=Lab,DC=ghost,DC=invalid
ACE: GHOST\\Helpdesk-Trainees -> ReadProperty
ACE: GHOST\\Audit-Readers -> ReadControl
ACE: GHOST\\Lab-Guests -> WriteDACL
review_marker=delegation_needs_limits
HINT

Lab-Guests should not control the object's DACL.

// 03 · PRACTICE

KNOWLEDGE CHECK

Which principal holds the overly broad delegated right?

// 04 · CAPTURE FLAG

Submit the review marker in SG{marker} format.

Progress stays in this browser.