Privileged allow ACE details should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Permissions and delegation · All checks

Run this check

Invoke-Maester -TestId AD-DACL-10

Overview

A count alone does not show where powerful ACEs are applied. Grouping privileged allow ACEs by object helps identify high-value directory objects that carry sensitive delegated rights.

• Object-Centric Review: Highlights which objects hold the most powerful ACEs.
• Delegation Validation: Makes it easier to confirm whether privileged rights are intentional.
• Attack Path Awareness: Sensitive permissions on administrative objects can enable escalation.

Control Type

Operational

Security Recommendation

Review objects with privileged allow ACEs and confirm the assigned identities and rights are justified. Reduce direct assignments where possible and prefer auditable group-based delegation.

How the Test Works

This test reads DaclEntries from Get-MtADDomainState, filters to allow ACEs containing GenericAll, WriteDacl, WriteOwner, or ExtendedRight, and groups the results by object.

Related Tests

• Test-MtAdDaclPrivilegedAllowAceCount
• Test-MtAdDaclIdentityAceDistribution
• Test-MtAdDaclPrivilegedExtendedRightDetails

Note: This test is LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use Invoke-Maester -IncludeLongRunning to run it.

Details

Every attribute of this check

Field	Value
Test ID	AD-DACL-10
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Permissions and delegation
Area	Privileged access
Resource type	Permission
MITRE ATT&CK	T1098 Account Manipulation, T1222.001 Windows Permissions
PowerShell test	Test-MtAdDaclPrivilegedAllowAceDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl
Long running	Yes

Source

• Test: tests/ad/dacl/Test.AD-DACL-10.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-10.md