What is a one sentence summary of your feature request?
Add a feature “Check for CreateChild permission”
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
Customer is concerned that AD objects with Create Child permissions can be used as an attack vector for exploiting dMSA as described here:
dMSA Ouroboros: Self-Sustaining Credential Extraction in Windows Server 2025 | Huntress.
How do you currently solve the challenges you have by not having this feature?
As to how they would like to see this check implemented - This should show up under “Anomalies analysis” and list the objects that have this permission.
