Privileged allow ACE count should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Permissions and delegation · All checks

Run this check

Invoke-Maester -TestId AD-DACL-09

Overview

Allow ACEs that grant GenericAll, WriteDacl, WriteOwner, or ExtendedRight can enable high-impact control over Active Directory objects. These permissions are commonly involved in privilege escalation and persistence paths.

• GenericAll: Grants broad control over the object.
• WriteDacl / WriteOwner: Enables permission tampering or ownership takeover.
• ExtendedRight: May allow sensitive control-access operations depending on object type.

Control Type

Operational

Security Recommendation

Limit privileged rights to tightly controlled administrative groups. Investigate unexpected identities or objects that accumulate these permissions.

How the Test Works

This test reads DaclEntries from Get-MtADDomainState, filters to allow ACEs, and counts entries where ActiveDirectoryRights includes GenericAll, WriteDacl, WriteOwner, or ExtendedRight.

Related Tests

• Test-MtAdDaclPrivilegedAllowAceDetails
• Test-MtAdDaclPrivilegedExtendedRightCount
• Test-MtAdDaclDistinctIdentityCount

Note: This test is LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use Invoke-Maester -IncludeLongRunning to run it.

Details

Every attribute of this check

Field	Value
Test ID	AD-DACL-09
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Permissions and delegation
Area	Privileged access
Resource type	Permission
MITRE ATT&CK	T1098 Account Manipulation, T1222.001 Windows Permissions
PowerShell test	Test-MtAdDaclPrivilegedAllowAceCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl
Long running	Yes

Source

• Test: tests/ad/dacl/Test.AD-DACL-09.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-09.md