Conflict object count should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Permissions and delegation · All checks

Run this check

Invoke-Maester -TestId AD-DACL-03

Overview

Conflict objects with CNF markers typically originate from replication or naming conflicts. Even when old, they can indicate historical AD hygiene issues and should be understood before being ignored.

• Surfaces replication-conflict remnants in DACL analysis
• Helps identify cleanup candidates
• Provides context for unexpected objects appearing in permission reviews

Control Type

Operational

Security Recommendation

Investigate conflict objects and confirm whether they are expected remnants, still referenced, or safe to clean up. Review their permissions before remediation to understand any delegated access that may still exist.

How the Test Works

This test retrieves $adState.DaclEntries, searches for CNF within ObjectDN, deduplicates matching distinguished names, and reports the number of unique conflict objects and associated DACL entries.

Related Tests

• Test-MtAdDaclConflictObjectDetails
• Test-MtAdDaclDistinctObjectCount
• Test-MtAdDaclDenyAceDetails

Note: This test is LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use Invoke-Maester -IncludeLongRunning to run it.

Details

Every attribute of this check

Field	Value
Test ID	AD-DACL-03
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Permissions and delegation
Area	Infrastructure hardening
Resource type	Tenant
MITRE ATT&CK	None
PowerShell test	Test-MtAdDaclConflictObjectCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl
Long running	Yes

Source

• Test: tests/ad/dacl/Test.AD-DACL-03.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-03.md