AD Permission Revocation
Remove one Active Directory permission entry from an object, down to a single right, instead of the whole permission.
Requires role: Operator or Admin to preview and simulate a removal. To authorize it in Semi-Auto, Operator for a plan built from a Critical or High finding, Admin for anything else. Operator or Admin to undo it.
Related: Select Fire™, Semi-Auto Execution, Remediation Action Catalog, Remediation Reversibility and Undo, Over-Permission Analytics, Critical Junctions
Overview
Active Directory grants most access through permission entries in an object's security descriptor, also called ACEs (access control entries). Select Fire™ removes these entries directly, with the same simulate-first steps it uses for group memberships. You can remove a whole entry, or one right from an entry that grants several.
It works the same wherever the exposure came from: an over-permissioned identity, a critical junction, a boundary escape path, a delegation finding, or a permission relationship you pick in the Graph Explorer.
The permission this matters for most is the right to copy a domain's password data (DCSync). Removing it by hand means editing the permissions of the domain object itself, which every domain controller depends on. Select Fire removes it as one reversible step, and the domain's built-in replication accounts can never be the target.
Prerequisites
- Role: Operator or Admin to preview and simulate. Authorizing a removal in Semi-Auto follows the same rule as any Select Fire action. See Semi-Auto Execution.
- Remediation credentials: An Admin sets up a dedicated Active Directory write account for the target domain. It's separate from the read-only sync account. It needs the right to change permissions (
WriteDacl) or ownership on the objects you plan to change. See Configuring Remediation Credentials. - Data: At least one successful sync, so the permission entries on the target object are loaded.
- Bridge: The Identity Bridge for the target's domain runs the removal. You can simulate while it's offline.
Removing a Permission Entry
1. Open Select Fire on the permission
Open Select Fire™ from a finding that involves the permission. You can also right-click the permission relationship in the Graph Explorer and select Select Fire. See Opening Select Fire for every way in.
2. Find the removable entry in the checklist
When Select Fire opens from a finding, the Preview step lists each way the account holds access as its own Access source row. A line under each name says what kind of source it is. A permission set directly on an object reads Set on this object, and a group membership reads Group membership. The account gets one row for each object it holds a direct permission on, named for that object.
These direct rows are the removable ones. Where the table has an Action column, they read Remove permissions instead of Simulate only. Expand a row to see exactly what it removes (next step). DCSync gets a row of its own, Replicate directory secrets. See Removing DCSync.
3. Choose which entries to remove
Expand the row. Under "Permission entries. Clear one to keep it." each entry has its own checkbox, with its rights in plain words. For example, it reads "Change permissions" instead of WriteDacl. A pill shows the kind of entry:
| Pill | Meaning |
|---|---|
| Explicit | Set directly on this object. You can remove it. |
| Inherited | Comes from a parent container. Remove it at that container instead. |
| Applies below | Applies to every object under this container. Remove it from the Delegation Risk page instead. |
| Built-in | A built-in replication holder. It's never removed. |
- Every removable entry starts checked, so it's removed unless you clear it.
- Clear an entry's checkbox to keep it.
- An entry you can't remove shows unchecked and disabled, with a line under it that says why. See What this can't remove yet, and why.
4. Removing DCSync (directory replication)
The DCSync row, Replicate directory secrets, starts checked. Active Directory grants DCSync through three rights. By default all three are removed together, because any one left in place still lets the account replicate.
Select Show rights to see the three rights: Replicating Directory Changes, Replicating Directory Changes All, and Replicating Directory Changes In Filtered Set. Clear one to keep it. The hint under them reads "Removing only “Replicating Directory Changes All” is enough to stop copying secrets."
The last checked right can't be cleared on its own. To keep every replication right, clear the whole row.
The account may also copy secrets through a broader permission you didn't select, such as full control of the domain. The Decision step then says so. Select Also remove the broader permission to include it, so the account loses the ability.
5. Simulate
Select Simulate. The blast radius covers exactly what you selected. If another entry on the same object also grants a right you removed, that right stays in the access shown, because the account keeps it. See Step 2: Simulate for how to read the panels.
6. Review and authorize in the Decision step
Go to the Decision step and select Semi-Auto. Each permission removal is its own action row. See The Semi-Auto Execution Panel. Under the row, a summary reads "Remove rights for account on object", followed by:
- Also removed with this entry: the other rights the same entry grants. They go with it, because an entry is removed whole.
- Still granted after this change: a right you selected that another entry on the object also grants. The removal hasn't failed. The account keeps that right through the other entry.
You authorize each permission removal yourself in Semi-Auto. Full-Auto doesn't run them. If the target is a Tier 0 object, such as the domain itself for a DCSync removal, you also type the object's name first. See Confirming a Change to a Protected Object.
7. Verify and undo
Once the directory confirms the removal, the row shows Verified. The graph updates without waiting for the next sync.
To reverse it, open Detection & Response > Remediation and select Undo on the entry. Undo puts the exact entry back at its original position in the permission list. See Remediation Reversibility and Undo, including what to expect when the object is protected.
A removed permission entry carries the Reversible from saved state badge. Undo restores the exact entry from a saved copy of the original state.
What this can't remove yet, and why
Some entries can't be removed, because the removal isn't safe yet or would break something. Each refusal says which, in plain words. None of them leaves the directory half-changed: if a check fails, nothing is written.
Shown as a disabled entry in the checklist
| What you see | Why |
|---|---|
| "Inherited from (container name). Remove it there instead." | The entry comes from a parent container. Select Review the delegation at (container name). See Remove a Delegation. |
| "This entry also applies to the objects below (container name). Remove it from the Delegation Risk page instead." | Removing it would change every object under the container, so it runs from the container with its own preview. The same button opens it. |
| "Inherited from a parent container. Removing it at the source isn't supported yet." | The source container couldn't be identified, so there is nowhere to route to. |
| "This is one of the built-in accounts or groups that hold these permissions for directory replication by design. Removing them could stop domain controllers from staying in sync." | Domain Controllers, Enterprise Domain Controllers and similar built-in holders need these rights. The entry is never offered, whoever is signed in. |
Shown on the action row in the Decision step
| What you see | Why |
|---|---|
| "None of the selected permissions comes from an entry that can be removed on this object." | Every right you selected comes from an inherited or built-in entry. |
| "This account can also copy directory secrets through a broader permission on the domain, such as full control. Removing the replication permissions alone would not stop it; include the broader permission in this change." | Removing the three DCSync rights alone wouldn't stop the account. Select Also remove the broader permission. |
| "This permission is also granted by another entry, so removing this one would not take it away." | Every right you selected is also granted by an inherited copy or another entry, so nothing is removed. |
| "Group Policy permissions are also stored on the policy's files, which aren't changed yet. Removing only the directory entry would leave control of the policy in place." | Removing only the directory entry would look like a fix while leaving control of the policy. Unlink the policy instead. |
Shown when you authorize the change
These depend on the object's current state, so they're checked when the change runs.
| What you see | Why |
|---|---|
| "This object's permissions are reset from the protected-accounts template every hour. Change the template instead." | The target belongs to a protected group, such as Domain Admins. Active Directory resets its permissions from the AdminSDHolder template about every hour, so a direct removal wouldn't last. |
| "The directory will remove this permission by itself within the hour, because this object is protected. No action is needed." | The object is protected, and this right already differs from the template. Active Directory removes it on its own. |
| "Removing this would take away the directory write account's right to change this object's permissions, so the change could never be undone." | The change would lock GraphnAI's write account out of this object, so undo could never run. It's refused for everyone, Admins included. |
| "No directory write account is set up for this domain. Add one under Remediation Credentials." | See Configuring Remediation Credentials. |
| "The directory write account isn't allowed to change this object's permissions. Nothing was changed." | The account is set up, but the directory refused the write. It likely lacks WriteDacl or ownership on this object. |
| "The domain controller this change was checked against isn't reachable, so nothing was changed. The change never moves to another controller partway through." | The check and the write run against one domain controller, so a stale copy on another controller is never used. Recompile once it's reachable. |
| "This domain's permissions can't be changed through a read-only domain controller." | The change was checked against a read-only domain controller. |
| "This object's permissions changed since the plan was made. Nothing was changed; recompile to retry." | Something else changed the object's permissions after the plan was built. Recompile the plan. |
| "Two identical entries match this permission, so it isn't clear which one to remove. Nothing was changed." | Remove the duplicate by hand in the directory. |
| "The directory returned different permissions from the ones that were checked, so nothing was changed." | The object's permissions didn't match the plan when the change ran. Recompile the plan. |
| "The permission change failed a safety check before it was written. Nothing was changed." | The new permission list failed a validity check, so it was never written. |
Working from Findings
Permission removal works from the same finding pages as any Select Fire action. See Working from Findings. You'll most often meet a removable permission entry here:
- Identity Inventory, with the Over-permissioned filter: a direct permission beyond what the account's peers hold.
- Critical Junctions: a permission entry that makes the account a junction between low-privilege and high-privilege areas.
- Detection Alerts: DCSync is a common alert. See Removing DCSync.
- Graph Explorer: right-click a permission relationship and select Select Fire to target it directly.
Troubleshooting
An entry has no checkbox, only a grey line of text
The entry is inherited from a parent container, or it applies to everything below a container, and it can't be removed from this object. If the line names a container, the entry lives there. Select Review the delegation at that container to remove it there. See Remove a Delegation.
The account can still do what the removal was meant to stop
Check the "Still granted after this change" line on the action row in the Decision step. If the right you removed is listed there, another entry on the same object still grants it. Remove that entry too. For DCSync, select Also remove the broader permission if it's offered.
"No directory write account is set up for this domain"
An Admin needs to set up a remediation credential for this domain before a removal can run. See Configuring Remediation Credentials. You can still preview and simulate the removal, but it can't run.
The Decision step offers a broader permission
This happens only for DCSync, when the account can replicate through a wider grant, such as full control of the domain, that your selection doesn't touch. Select Also remove the broader permission to include it in the same removal. If you leave it, the account keeps DCSync through that grant.
A permission on a Group Policy object isn't offered for removal
Group Policy permissions also live on the policy's files, which aren't changed yet. Removing only the directory entry would look like a fix while leaving control of the policy in place. Unlink the policy from the container instead.
The confirmation asks for the domain name
A DCSync removal on the domain itself targets a Tier 0 object, so this is expected. Type the domain name exactly as shown. See Confirming a Change to a Protected Object, including why an API key can never give this confirmation.
Undo doesn't restore the permission
The object's permissions changed after the removal, because someone edited them or the directory reset a protected object. Putting the entry back at its original position would then leave the list out of order, so Undo refuses. The message reads "This object's permissions changed since the removal, so restoring the entry at its original position would put the list out of order. Nothing was changed; restore it manually." Restore the entry by hand in the directory. See Remediation Reversibility and Undo.