Impacket dacledit Target Selection

The failure this note addresses

The failing command supplied a short OU label to -target-dn:

-target-dn 'SERVICE ACCOUNTS'

dacledit.py then reported that the target principal was not found. The LDAP connection and requested rights were not the immediate problem: -target-dn performs a distinguishedName lookup, and SERVICE ACCOUNTS is a short object label rather than a DN.

The working value contains the object’s complete directory path:

-target-dn 'OU=Service Accounts,OU=Enterprise IT,DC=lab,DC=example,DC=test'

For a GPO, the equivalent fix is the complete CN={GUID},CN=Policies,CN=System,... value rather than the GPO display name.

Choose the target selector

dacledit.py accepts three target selectors. They are not interchangeable:

What identifies the object?
├─ sAMAccountName ───────────────> -target '<SAM_ACCOUNT_NAME>'
├─ objectSid ────────────────────> -target-sid '<SID>'
└─ full distinguishedName ──────> -target-dn '<FULL_DN>'
                                   ├─ OU=...
                                   └─ CN={GPO-GUID},CN=Policies,CN=System,...

Target object	Value to copy	Selector
User, computer, or group	`sAMAccountName`	`-target`
Any object with a known SID	`objectSid`	`-target-sid`
OU, container, or GPO LDAP object	Complete `distinguishedName`	`-target-dn`

-target is valid for an object with a known sAMAccountName, such as a user, computer, or group. OUs, containers, and GPO objects should normally be selected with -target-dn because a short label is not a distinguished name and those objects do not provide a useful sAMAccountName target.

Not a DN:  SERVICE ACCOUNTS
Full DN:   OU=Service Accounts,OU=Enterprise IT,DC=lab,DC=example,DC=test

For a GPO, the LDAP object is under the domain’s CN=Policies,CN=System container:

CN={11111111-2222-3333-4444-555555555555},CN=Policies,CN=System,DC=lab,DC=example,DC=test

The GUID and directory path must come from the selected object. Do not replace them with the GPO display name.

Get the full DN from BloodHound

Search for and select the intended object in BloodHound. In the object details, copy the complete Distinguished Name property, named distinguishedname in graph data. Preserve every OU=, CN=, and DC= component in order.

BloodHound reflects the last collected directory state. If the object may have moved or been renamed, treat the copied value as a candidate and perform the read operation below before any write. A failed lookup is a reason to refresh the DN, not to shorten it.

Read the OU DACL first

Read the DACL before attempting a write:

dacledit.py \
  -action read \
  -principal-sid 'S-1-5-21-1111111111-2222222222-3333333333-1107' \
  -target-dn 'OU=Service Accounts,OU=Enterprise IT,DC=lab,DC=example,DC=test' \
  -dc-ip '192.0.2.10' \
  'lab.example.test/operator'

The identity argument is the account used to authenticate to LDAP. -principal-sid identifies the trustee whose ACEs should be displayed or written. -target-dn identifies the object whose DACL is being read or changed.

Confirm that the output resolves the intended target and principal before changing -action read to -action write.

Add an inheritable ACE to an OU

When the approved test requires child objects to inherit the ACE from an OU:

On a POSIX operator host, set a restrictive file-creation mask first. dacledit.py writes a DACL backup before attempting the change, and the backup contains the target’s security descriptor:

umask 077

dacledit.py \
  -action write \
  -rights FullControl \
  -inheritance \
  -principal-sid 'S-1-5-21-1111111111-2222222222-3333333333-1107' \
  -target-dn 'OU=Service Accounts,OU=Enterprise IT,DC=lab,DC=example,DC=test' \
  -dc-ip '192.0.2.10' \
  'lab.example.test/operator'

-inheritance sets container- and object-inherit flags on the new ACE. It does not override protected ACLs. An object whose DACL blocks inheritance—including an object currently protected by AdminSDHolder—will not inherit the OU ACE. adminCount=1 is a useful review signal, but the value can remain after an object is no longer protected; verify the object’s current inheritance state instead of relying on that attribute alone.

FullControl is broad. Use only the rights required by the approved test case. Writing an ACE changes directory state and can affect every inheriting child object.

Select a GPO object by its full DN

To operate directly on the GPO’s directory object, use its complete CN={GUID},CN=Policies,CN=System,... DN. Run the same command with -action read first, then use the write action only after confirming the resolved object and trustee:

dacledit.py \
  -action write \
  -rights FullControl \
  -principal-sid 'S-1-5-21-1111111111-2222222222-3333333333-1107' \
  -target-dn 'CN={11111111-2222-3333-4444-555555555555},CN=Policies,CN=System,DC=lab,DC=example,DC=test' \
  -dc-ip '192.0.2.10' \
  'lab.example.test/operator'

This changes the DACL of the GPO’s LDAP object. It does not by itself establish the permissions or contents of the corresponding Group Policy Template in SYSVOL; assess and validate that separate object only when it is in scope.

Preserve and restore the DACL

Before a write, current Impacket dacledit.py saves the original security descriptor to a timestamped dacledit-*.bak file in the current directory unless -file specifies another path. Record the exact backup path printed by the command and protect it as assessment evidence.

After validation, restore that saved DACL when cleanup is required:

dacledit.py \
  -action restore \
  -file '<DACLEDIT_BACKUP_FILE>' \
  -dc-ip '192.0.2.10' \
  'lab.example.test/operator'

Read the DACL again after the write and after restoration. Do not assume a successful LDAP response proves that inheritance produced the intended effective permissions on every child.

Restoration replaces the target’s DACL with the saved version. Before restoring, confirm that no legitimate ACE changes were made after the backup; otherwise restoration can discard those intervening changes. Coordinate cleanup with the directory owner when the object may be administered concurrently.