DACL ACE distribution per identity should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Permissions and delegation · All checks

Run this check

Invoke-Maester -TestId AD-DACL-08

Overview

Knowing which identities appear most frequently in DACLs helps identify central delegation patterns, inherited administrative groups, and accounts that may have accumulated permissions over time.

• Hotspot Detection: Frequently occurring identities can represent broad administrative reach.
• Permission Hygiene: Distribution data helps distinguish expected administrative groups from unusual direct assignments.
• Operational Review: Repeated counts per identity make it easier to validate changes after cleanup or redesign.

Control Type

Operational

Security Recommendation

Review identities with unusually high ACE counts. Confirm they are expected administrative groups and not stale accounts, orphaned SIDs, or overly broad delegated principals.

How the Test Works

This test reads DaclEntries from Get-MtADDomainState, groups entries by IdentityReference, and reports the number of ACEs associated with each identity.

Related Tests

• Test-MtAdDaclDistinctIdentityCount
• Test-MtAdDaclPrivilegedAllowAceDetails
• Test-MtAdDaclPrivilegedExtendedRightDetails

Note: This test is LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use Invoke-Maester -IncludeLongRunning to run it.

Details

Every attribute of this check

Field	Value
Test ID	AD-DACL-08
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Permissions and delegation
Area	Access control
Resource type	Permission
MITRE ATT&CK	None
PowerShell test	Test-MtAdDaclIdentityAceDistribution
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl
Long running	Yes

Source

• Test: tests/ad/dacl/Test.AD-DACL-08.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-08.md