Distinct DACL object count should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Permissions and delegation · All checks

Run this check

Invoke-Maester -TestId AD-DACL-01

Overview

Knowing how many distinct Active Directory objects are represented in the collected DACL dataset helps establish the scope of permission analysis.

• Measures DACL coverage across collected directory objects
• Provides a baseline for comparing later DACL metrics
• Helps validate collection breadth when reviewing AD permission visibility

Control Type

Operational

Security Recommendation

Use this count as a baseline metric when reviewing DACL analysis. Unexpectedly low counts can indicate collection gaps, limited visibility, or an unexpectedly small review scope.

How the Test Works

This test retrieves $adState.DaclEntries, extracts the ObjectDN value from each entry, deduplicates the object list, and reports the total number of unique objects with DACL entries.

Related Tests

• Test-MtAdDaclOuObjectCount
• Test-MtAdDaclConflictObjectCount
• Test-MtAdDaclDenyAceCount

Note: This test is LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use Invoke-Maester -IncludeLongRunning to run it.

Details

Every attribute of this check

Field	Value
Test ID	AD-DACL-01
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Permissions and delegation
Area	Access control
Resource type	Permission
MITRE ATT&CK	None
PowerShell test	Test-MtAdDaclDistinctObjectCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl
Long running	Yes

Source

• Test: tests/ad/dacl/Test.AD-DACL-01.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-01.md