Conflict object details should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Permissions and delegation · All checks

Run this check

Invoke-Maester -TestId AD-DACL-04

Overview

High-level counts are useful, but remediation usually requires object-level detail. This test helps administrators pinpoint each conflict object present in the DACL dataset and understand how many ACEs are attached to it.

• Shows the exact conflict objects found in DACL analysis
• Supports cleanup validation by exposing object class and DN
• Quantifies ACE volume on each conflict object

Control Type

Operational

Security Recommendation

Review each listed conflict object, confirm why it exists, and determine whether it is still needed. If an object is obsolete, validate dependencies and permissions before cleanup.

How the Test Works

This test retrieves $adState.DaclEntries, filters for entries whose ObjectDN contains CNF, groups them by object distinguished name, and returns each object with its class and ACE count.

Related Tests

• Test-MtAdDaclConflictObjectCount
• Test-MtAdDaclDenyAceDetails
• Test-MtAdDaclOuObjectCount

Note: This test is LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use Invoke-Maester -IncludeLongRunning to run it.

Details

Every attribute of this check

Field	Value
Test ID	AD-DACL-04
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Permissions and delegation
Area	Infrastructure hardening
Resource type	Tenant
MITRE ATT&CK	None
PowerShell test	Test-MtAdDaclConflictObjectDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl
Long running	Yes

Source

• Test: tests/ad/dacl/Test.AD-DACL-04.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-04.md