Deny ACE count should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Permissions and delegation · All checks

Run this check

Invoke-Maester -TestId AD-DACL-05

Overview

Deny ACEs are powerful because they can override allow permissions and create access outcomes that are difficult to troubleshoot. Counting them provides a quick baseline for how much explicit denial logic exists in the collected AD permission set.

• Highlights explicit deny usage in AD DACLs
• Supports troubleshooting for delegation and access issues
• Helps prioritize deeper review when deny ACE volume is high

Control Type

Operational

Security Recommendation

Review deny ACE usage carefully. Ensure each deny entry is intentional, documented, and still required. Excessive or poorly understood deny entries can create administrative confusion and mask broader permission issues.

How the Test Works

This test retrieves $adState.DaclEntries, filters entries where AccessControlType contains Deny, and reports the total deny ACE count along with the number of affected objects.

Related Tests

• Test-MtAdDaclDenyAceDetails
• Test-MtAdDaclDistinctObjectCount
• Test-MtAdDaclOuObjectCount

Note: This test is LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use Invoke-Maester -IncludeLongRunning to run it.

Details

Every attribute of this check

Field	Value
Test ID	AD-DACL-05
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Permissions and delegation
Area	Access control
Resource type	Permission
MITRE ATT&CK	None
PowerShell test	Test-MtAdDaclDenyAceCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl
Long running	Yes

Source

• Test: tests/ad/dacl/Test.AD-DACL-05.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-05.md