NetExec daclread Module

Read the DACL of an arbitrary AD object via LDAP and resolve every ACE to a human-readable principal/right pair. Faster than spinning up BloodHound when you only need to confirm one path.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool

nxc

Category

Enumeration / LDAP

Platform

linux

Requires

password

Protocols

LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc ldap <target> -u '<user>' -p '<password>' -M daclread -o TARGET='<object>' ACTION=read

Examples

nxc ldap dc.corp.local -u jdoe -p 'Password123!' -M daclread -o TARGET=Administrator ACTION=read

Tags

netexec nxc daclread acl enumeration

References

• NetExec daclread

Related commands

• BloodHound AD Collection Collect Active Directory data for BloodHound analysis
• bloodyAD get children List the immediate children of a container or OU. Handy for walking the directory tree…
• bloodyAD get dnsDump Dump every AD-integrated DNS record from the domain. Authenticated users can read most…
• bloodyAD get membership Recursively resolve every group a principal belongs to, including nested groups. Faster…
• bloodyAD Get Object Attributes Read all (or specific) LDAP attributes of an AD object. Useful for confirming…
• bloodyAD get search Run an arbitrary LDAP filter against the directory and pull selected attributes. The…
• bloodyAD get trusts Enumerate domain and forest trust relationships, including direction, type, and trust…
• bloodyAD get writable Enumerate every AD object the current principal can write to — fastest path to finding…