Privileged extended right count should be investigated
Part of Active Directory · Active Directory · Permissions and delegation · All checks
Invoke-Maester -TestId AD-DACL-11Overview
Section titled “Overview”Extended rights control specific privileged operations in Active Directory, such as sensitive control-access permissions tied to object classes or administrative workflows. Understanding how often they are delegated helps surface potentially risky permission models.
- Sensitive Operations: Some extended rights can enable password resets, replication access, or other administrative actions.
- Delegation Mapping: Counting these ACEs helps you understand how broadly control-access permissions are assigned.
- Scope Awareness: Distinct
ObjectTypevalues show how granular or broad the delegation is.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review principals granted extended rights and verify that those delegations are necessary, documented, and limited to the smallest practical scope.
How the Test Works
Section titled “How the Test Works”This test reads DaclEntries from Get-MtADDomainState, filters to allow ACEs whose ActiveDirectoryRights includes ExtendedRight, and reports counts across identities, objects, and object types.
Related Tests
Section titled “Related Tests”Test-MtAdDaclPrivilegedExtendedRightDetailsTest-MtAdDaclPrivilegedAllowAceCountTest-MtAdDaclPrivilegedAllowAceDetails
Note: This test is
LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. UseInvoke-Maester -IncludeLongRunningto run it.
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DACL-11 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Area | Privileged access |
| Resource type | Permission |
| MITRE ATT&CK | T1003.006 DCSync, T1098 Account Manipulation |
| PowerShell test | Test-MtAdDaclPrivilegedExtendedRightCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
| Long running | Yes |
Source
Section titled “Source”- Test:
tests/ad/dacl/Test.AD-DACL-11.ps1 - Documentation:
tests/ad/dacl/Test.AD-DACL-11.md