Using PowerView

Note:- You need to transfer powerView.ps1 on the host and import it.

To find interesting ACL with modification rights set to non-built in objects.

Find-InterestingDomainAcl	

To enumerate ACL of a specific user.

Import-Module .\PowerView.ps1 $sid = Convert-NameToSid wley	

Get-DomainObjectACL -Identity * | ? {$_.SecurityIdentifier -eq $sid}