Skip to main content
Version: 2.2.1-preview

AD-DACL-02 - OU DACL entry count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Organizational Units are a common delegation boundary in Active Directory. Understanding how many DACL entries apply to OU objects helps focus permission review on objects that commonly control administration and policy scoping.

  • Highlights OU permission surface area
  • Supports delegation review for administrative boundaries
  • Provides context for OU-focused DACL investigations

Security Recommendation​

Review OU permissions regularly, especially where OUs host privileged users, servers, or administrative delegation models. Unexpectedly large or complex OU ACLs can indicate legacy delegation that should be validated.

How the Test Works​

This test retrieves $adState.DaclEntries, filters entries where ObjectClass equals organizationalUnit, and reports the count of OU DACL entries and distinct OU objects represented.

  • Test-MtAdDaclDistinctObjectCount
  • Test-MtAdDaclDenyAceCount
  • Test-MtAdDaclDenyAceDetails

Test Metadata​

FieldValue
Test IDAD-DACL-02
SeverityInfo
SuiteActive Directory
CategoryAD.DACL
PowerShell testTest-MtAdDaclOuObjectCount
TagsAD, AD-DACL-02, AD.DACL

Source​

  • Pester test: tests/ad/dacl/Test-MtAdDaclOuObjectCount.Tests.ps1
  • PowerShell source: powershell/public/ad/dacl/Test-MtAdDaclOuObjectCount.ps1