https://leikah.haoyingcao.xyz/en/tags/shadow-credentials/Recent content in Shadow Credentials on LEIKAHHugoenhttps://leikah.haoyingcao.xyz/en/docs/active_directory/movement/acl_abuse/control_over_user/Mon, 01 Jan 0001 00:00:00 +0000https://leikah.haoyingcao.xyz/en/docs/active_directory/movement/acl_abuse/control_over_user/<h2 id="force-change-password">Force Change Password<a class="td-heading-self-link" href="#force-change-password" aria-label="Heading self-link"></a></h2> <p>The most naive method is to simply change that user&rsquo;s password. With <code>ForceChangePassword</code> access, which is included with <code>GenericAll</code> access on a user, we should be able to change that user&rsquo;s password without knowing their current password.</p> <div class="alert alert-primary" role="alert"><div class="h4 alert-heading" role="heading">Note</div> <p>Change an account&rsquo;s password is considered <strong>destructive</strong> to the environment due to the potential disruption it may cause. With the account&rsquo;s password changed, Users may not be able to log in. If the account is a service account, the service can become unavailable. During real-life engagements, only use this technique if written consent from the client is obtained.</p>