OU DACL entry count should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Permissions and delegation · All checks

Run this check

Invoke-Maester -TestId AD-DACL-02

Overview

Organizational Units are a common delegation boundary in Active Directory. Understanding how many DACL entries apply to OU objects helps focus permission review on objects that commonly control administration and policy scoping.

• Highlights OU permission surface area
• Supports delegation review for administrative boundaries
• Provides context for OU-focused DACL investigations

Control Type

Operational

Security Recommendation

Review OU permissions regularly, especially where OUs host privileged users, servers, or administrative delegation models. Unexpectedly large or complex OU ACLs can indicate legacy delegation that should be validated.

How the Test Works

This test retrieves $adState.DaclEntries, filters entries where ObjectClass equals organizationalUnit, and reports the count of OU DACL entries and distinct OU objects represented.

Related Tests

• Test-MtAdDaclDistinctObjectCount
• Test-MtAdDaclDenyAceCount
• Test-MtAdDaclDenyAceDetails

Note: This test is LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use Invoke-Maester -IncludeLongRunning to run it.

Details

Every attribute of this check

Field	Value
Test ID	AD-DACL-02
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Permissions and delegation
Area	Access control
Resource type	OrganizationalUnit
MITRE ATT&CK	None
PowerShell test	Test-MtAdDaclOuObjectCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl
Long running	Yes

Source

• Test: tests/ad/dacl/Test.AD-DACL-02.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-02.md