Deny ACE details should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Permissions and delegation · All checks

Run this check

Invoke-Maester -TestId AD-DACL-06

Overview

When deny ACEs exist, administrators need to know exactly which identities are denied on which objects. Grouping deny ACEs by object and identity makes it easier to review intent and spot concentrated or unusual deny patterns.

• Maps denied principals to specific objects
• Supports delegated access reviews
• Helps identify concentrated deny patterns that deserve validation

Control Type

Operational

Security Recommendation

Review each deny ACE grouping to confirm it reflects an intentional control. Focus especially on privileged objects, administrative groups, and OUs used for delegation.

How the Test Works

This test retrieves $adState.DaclEntries, filters entries where AccessControlType contains Deny, groups results by ObjectDN and IdentityReference, and reports the count of deny ACEs for each combination.

Related Tests

• Test-MtAdDaclDenyAceCount
• Test-MtAdDaclConflictObjectDetails
• Test-MtAdDaclOuObjectCount

Note: This test is LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use Invoke-Maester -IncludeLongRunning to run it.

Details

Every attribute of this check

Field	Value
Test ID	AD-DACL-06
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Permissions and delegation
Area	Access control
Resource type	Permission
MITRE ATT&CK	None
PowerShell test	Test-MtAdDaclDenyAceDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl
Long running	Yes

Source

• Test: tests/ad/dacl/Test.AD-DACL-06.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-06.md