Distinct DACL identity count should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Permissions and delegation · All checks

Run this check

Invoke-Maester -TestId AD-DACL-07

Overview

Every DACL ACE references a security principal. Tracking the number of distinct identities appearing in delegated permissions helps you understand how widely access has been spread across the directory.

• Delegation Visibility: A large number of distinct identities can indicate broad or inconsistent delegation.
• Review Prioritization: Security teams can focus on identities that appear repeatedly across sensitive objects.
• Baseline Tracking: Repeated measurement makes it easier to spot growth in delegated access over time.

Control Type

Operational

Security Recommendation

Keep delegation models simple and intentional. Prefer group-based administration over direct assignment to many individual accounts or SIDs.

How the Test Works

This test reads DaclEntries from Get-MtADDomainState, extracts unique IdentityReference values, and reports how many distinct identities appear across all collected ACEs.

Related Tests

• Test-MtAdDaclIdentityAceDistribution
• Test-MtAdDaclPrivilegedAllowAceCount
• Test-MtAdDaclPrivilegedExtendedRightCount

Note: This test is LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use Invoke-Maester -IncludeLongRunning to run it.

Details

Every attribute of this check

Field	Value
Test ID	AD-DACL-07
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Permissions and delegation
Area	Access control
Resource type	Permission
MITRE ATT&CK	None
PowerShell test	Test-MtAdDaclDistinctIdentityCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl
Long running	Yes

Source

• Test: tests/ad/dacl/Test.AD-DACL-07.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-07.md