How to Use the dsacls Command in Windows to Audit and Modify Active Directory Object Permissions

In Microsoft Windows enterprise environments governed by Active Directory Domain Services (AD DS), access control to directory objects—such as Organisational Units (OUs), user accounts, security groups, and computer objects—is enforced through Discretionary Access Control Lists (DACLs). While administrators frequently use the Active Directory Users and Computers (ADUC) graphical console or the Delegation of Control Wizard to assign rights, graphical tools can be cumbersome, prone to accidental misconfigurations, and difficult to automate across complex multi-domain forests. For precise, scriptable auditing and modification of directory security descriptors from the command line, Windows provides a native administrative command-line utility: dsacls.

Included with the Remote Server Administration Tools (RSAT) and natively present on Windows Server domain controllers, dsacls.exe interacts directly with the Active Directory security subsystem. It allows system engineers to inspect inherited rights, assign granular attribute-level permissions (such as allowing help desk staff to reset passwords without granting full object control), and strip anomalous Access Control Entries (ACEs). This comprehensive guide explains the architecture of Active Directory security descriptors, details the exact syntax and permission flags used by dsacls, and demonstrates practical administrative workflows for delegation and permission auditing.

Active Directory Security Descriptors and Tooling Comparison

Every object in Active Directory contains a security descriptor comprising an Owner SID, a Group SID, a Discretionary Access Control List (DACL) that defines who has permissions, and a System Access Control List (SACL) that defines auditing policies. Choosing the appropriate tool to inspect and manipulate these entries is critical for directory hygiene:

Tool / Utility	Primary Interface	Granular Attribute Control	Best Use Case
dsacls.exe	Command Line / Batch / PowerShell	Exceptional (native schema attribute mapping)	Scripted delegation, bulk permission auditing, ACL restoration.
Active Directory Users & Computers	Graphical Console (MMC)	Moderate (via Advanced Security tab)	Ad-hoc visual audits and manual single-object permission checks.
PowerShell (Get-Acl / Set-Acl)	PowerShell ActiveDirectory: drive	High (requires complex .NET ACE object construction)	Complex programmatic automation within PowerShell modules.
Ldp.exe	Low-level GUI LDAP client	Raw binary / SDDL representation	Deep diagnostic analysis of raw security descriptors and schema.

Auditing Existing Permissions on an Active Directory Object

To inspect the security descriptor of an object using dsacls, open an elevated Command Prompt or Windows PowerShell console (running with domain administrator credentials) and specify the object’s full Distinguished Name (DN):

dsacls "OU=Finance,DC=corp,DC=digitash,DC=com"

The command outputs the complete security descriptor, including the object owner, inherited permissions, and individual Access Control Entries (ACEs):

Owner: CORP\Domain Admins
Group: CORP\Domain Admins

Access list:
Effective Permissions on this object:
Allow NT AUTHORITY\SYSTEM                SPECIAL READ
                                          DELETE CHILD
                                          LIST CHILDREN
                                          READ PROPERTY
Allow CORP\HelpDesk-Tier1                 SPECIAL WRITE
                                          WRITE PROPERTY (lockoutTime)
                                          WRITE PROPERTY (pwdLastSet)
Allow CORP\Domain Admins                  GENERIC ALL

Each entry displays the trustee (the user or group receiving the right), whether the entry is an Allow or Deny ACE, and the specific permissions granted.

Understanding dsacls Permission Codes and Inheritance Flags

When modifying security descriptors, dsacls uses short two-letter permission codes representing standard Windows security rights and Active Directory extended rights:

Code	Standard Permission Meaning	Code	Extended / Property Permission
GA	Generic All (Full Control)	RP	Read Property
GR	Generic Read	WP	Write Property
GW	Generic Write	CC	Create Child Object
RC	Read Control (Read Security Descriptor)	DC	Delete Child Object
WD	Write DACL (Modify Permissions)	WO	Write Owner (Take Ownership)

Inheritance is controlled using the /I parameter:

• /I:T (This object and sub-objects): Propagates permissions to the specified container and all descendant objects.
• /I:S (Sub-objects only): Applies permissions strictly to descendant objects without affecting the container itself.
• /I:P (Propagate inheritable): Marks permissions as inheritable so child containers can pass them down.

Granting and Delegating Permissions with dsacls

The standard syntax for granting permissions is:

dsacls <Target_DN> /G <Trustee>:<Permissions>

Example 1: Delegating User Account Unlocks to Help Desk

To delegate the ability to unlock locked user accounts inside the OU=Staff,DC=corp,DC=digitash,DC=com container to the HelpDesk-Tier1 security group, administrators only need to grant write permissions on the lockoutTime attribute across all descendant user objects:

dsacls "OU=Staff,DC=corp,DC=digitash,DC=com" /I:S /G "CORP\HelpDesk-Tier1:WP;lockoutTime;user"

In this command:

• /I:S instructs Active Directory to apply the rule to child objects only.
• WP specifies Write Property.
• lockoutTime specifies the exact attribute schema name.
• user limits the scope exclusively to user class objects inside the OU.

Example 2: Delegating Password Reset Rights

Resetting a user password requires the extended Active Directory right “Reset Password” (identified by the schema display name or GUID {00299570-246d-11d0-a768-00aa006e0529}). To grant this right:

dsacls "OU=Staff,DC=corp,DC=digitash,DC=com" /I:S /G "CORP\HelpDesk-Tier1:CA;Reset Password;user"

The CA code denotes “Control Access” (Extended Right), enabling password resets while preventing unauthorised modifications to other sensitive user attributes.

Revoking Permissions and Stripping Trustees

To remove all explicit permissions granted to a specific user or group on an Active Directory object, use the /R (Revoke) parameter:

dsacls "OU=Finance,DC=corp,DC=digitash,DC=com" /R "CORP\TemporaryContractors"

This command strips all matching ACEs belonging to the specified trustee from the object’s DACL while leaving other trustees intact.

Restoring Default Canonical Permissions

If an Organisational Unit or critical container has suffered severe permission drift or unauthorised alterations, dsacls can reinstate the canonical default security descriptor defined in the Active Directory schema for that object class:

dsacls "OU=Finance,DC=corp,DC=digitash,DC=com" /resetdefaultdacl

When executed, dsacls prompts for confirmation before purging custom ACEs and reapplying the default schema template, instantly restoring standard inheritance and administrative ownership.

Best Practices for Active Directory ACL Administration

To maintain enterprise directory stability and minimise security risks when modifying permissions:

• Target Security Groups, Never Individual Users: Always assign permissions to dedicated role-based security groups (e.g., Role-HR-AccountOperators) rather than individual user accounts.
• Always Audit Before Applying Changes: Run dsacls <DN> > backup_acl.txt before modifying production containers so you have an immediate textual reference of the pre-existing state.
• Adhere to the Principle of Least Privilege: Avoid assigning GA (Generic All) or full write access when specific attribute delegation (such as WP;telephoneNumber) satisfies operational requirements.

By mastering the dsacls utility, Windows domain administrators can execute rapid, repeatable, and audited permission changes across Active Directory without relying on slow manual GUI navigation.