I was querying a domain and found an interesting ACL that I haven't seen before.

One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain computer account object using the generated clear-text password could use mstsc.exe to RDP in? Or is there more AD trickery behind the scenes? What would the practical reason be?

Thanks in advance!

  • 2
    CanRDP doesn't sound like a native Active Directory right, to me. Are you running third party software in AD that extends the functionality? Something related to Bloodhound 2.0 judging from a quick google search? – HackneyB Jan 31 at 19:33
  • Yeah, I was gathering domain information using that. – ptr0x01 Feb 1 at 6:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.