GenericAll

What GenericAll Means in Directory Permissions

GenericAll is a very broad delegated permission, so the security issue is not the label itself but the amount of control it conveys. In directory services, that level of access can let a principal change object properties, reset or influence security settings, and alter how the object is governed, which makes it materially different from a narrow read or write permission.

Where GenericAll Becomes Dangerous

The danger comes from scope and inheritance. If GenericAll is granted on a user, group, computer, or service object, the grantee may be able to reshape that object into a foothold for further abuse, including privilege escalation, persistence, and misuse of delegated administrative power. On directory objects, broad control often matters more than ownership of a single account because it can cascade into group membership, authentication, and access changes.

A useful way to think about it is that GenericAll can turn a delegated object into an administrative surrogate. That is why dangerous permissions on high-value directory objects are often treated as path-building conditions rather than simple misconfigurations.

How Organisations Find and Validate Exposure

Exposure review starts with inventory, because GenericAll is only meaningful when you know which objects carry it and who inherits it. Administrators should review directory ACLs, confirm whether the right applies directly or through delegation, and compare those results against intended admin boundaries for users, groups, computers, and service objects.

Review should also focus on where the permission lands. GenericAll on privileged groups, Tier 0 assets, administrative workstations, or service accounts deserves more scrutiny than the same right on low-value objects. Audit logs can help confirm when ACLs change, and change review should separate legitimate delegation from accidental over-permissioning. The Active Directory ACL and Delegation Hygiene Guide is a practical reference for identifying and cleaning up dangerous directory permissions, while the Identity Attack Paths Guide helps place that exposure into attack-path context.

Remediation, Detection, and Access Reduction

When GenericAll is found, remediation usually means narrowing the delegated scope, replacing direct object-level grants with role-based delegation, and removing rights that are broader than the business task requires. If immediate removal is not possible, compensating controls should reduce the blast radius by isolating sensitive objects, tightening monitoring, and limiting which operators can create or modify the affected ACLs.

Detection should look for follow-on actions that make use of the right, such as unexpected object modification, group membership changes, password resets, ownership changes, or the creation of new access paths. Because this permission is often used as an enabler rather than the final objective, post-change review should ask whether the object was altered in ways that could support persistence or privilege escalation. Broad control on directory objects is especially relevant to path reduction work, and the attack-path perspective in the Identity Attack Paths Guide is directly useful here.

Why GenericAll Matters in Governance

GenericAll is a governance problem as much as a technical one, because it represents a delegation decision that can outlive the person or team that requested it. If organisations do not treat broad ACLs as privileged access, they often lose track of who can change security-sensitive directory objects and why that access still exists.

The practical standard is simple: every GenericAll grant should have an explicit owner, a documented purpose, and a planned review date. Without that discipline, directory delegation gradually becomes indistinguishable from hidden administrative power.

Practitioner Guidance

Why practitioners should care: GenericAll is one of the permissions most likely to create accidental privilege escalation, because it can be broad enough to alter security-critical properties without looking like a traditional admin role. Treat it as a high-risk access grant, not a routine delegation choice.

What to watch for: Pay special attention when GenericAll appears on privileged groups, service objects, or accounts that can influence authentication or directory trust relationships. Those are the grants most likely to become a stepping stone for persistence or lateral movement.

Governance implication: Use a formal review process for any delegation that includes GenericAll, with explicit justification for why narrower rights are not sufficient. If the business task can be done with a smaller permission set, GenericAll is usually too much.