Skip to main content
Version: 2.2.1-preview

AD-DACL-06 - Deny ACE details should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

When deny ACEs exist, administrators need to know exactly which identities are denied on which objects. Grouping deny ACEs by object and identity makes it easier to review intent and spot concentrated or unusual deny patterns.

  • Maps denied principals to specific objects
  • Supports delegated access reviews
  • Helps identify concentrated deny patterns that deserve validation

Security Recommendation​

Review each deny ACE grouping to confirm it reflects an intentional control. Focus especially on privileged objects, administrative groups, and OUs used for delegation.

How the Test Works​

This test retrieves $adState.DaclEntries, filters entries where AccessControlType contains Deny, groups results by ObjectDN and IdentityReference, and reports the count of deny ACEs for each combination.

  • Test-MtAdDaclDenyAceCount
  • Test-MtAdDaclConflictObjectDetails
  • Test-MtAdDaclOuObjectCount

Test Metadata​

FieldValue
Test IDAD-DACL-06
SeverityInfo
SuiteActive Directory
CategoryAD.DACL
PowerShell testTest-MtAdDaclDenyAceDetails
TagsAD, AD-DACL-06, AD.DACL

Source​

  • Pester test: tests/ad/dacl/Test-MtAdDaclDenyAceDetails.Tests.ps1
  • PowerShell source: powershell/public/ad/dacl/Test-MtAdDaclDenyAceDetails.ps1