Computer

ACLs/ACEs permissions on Computer

Generic All / Generic Write

If object: msDs-AllowedToActOnBehalf, then RBCD can be performed

If we can add Key Credentials, we can perform a Shadow Credentials attack