AD-DACL-FORCECHANGECredential Access

ForceChangePassword (User-Force-Change-Password)

Reset a user's password without knowing the old one — extended-right ACE.

§ Where this technique fits

AD-DACL-FORCECHANGE is catalogued under the Credential Access tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 4 on average.

§ Dossiers chaining this technique

WriteDACL on a privileged user → ForceChangePassword → takeover
Discover a misconfigured ACL that lets a low-priv user modify the ACL of a Tier-0 account, grant ForceChangePassword to themselves, reset the victim's password, and log in.
step 4 / 6

§ What commonly comes next

01
Valid Accounts
T1078 · Initial Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

WriteDACL on a privileged user → ForceChangePassword → takeover

§ What commonly comes next