Privileged extended right details should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Permissions and delegation · All checks

Run this check

Invoke-Maester -TestId AD-DACL-12

Overview

Extended rights are most useful when you can see which specific ObjectType values are being delegated. Grouping ACEs by GUID reveals whether permissions are narrowly targeted or broadly applied.

• GUID-Level Visibility: Highlights which extended-right object types occur most often.
• Delegation Review: Helps correlate control-access permissions with documented administration patterns.
• Change Tracking: Makes it easier to compare extended-right usage over time.

Control Type

Operational

Security Recommendation

Document the purpose of delegated extended rights and review object types with high counts or unexpected identity coverage.

How the Test Works

This test reads DaclEntries from Get-MtADDomainState, filters to allow ACEs containing ExtendedRight, normalizes missing ObjectType values, and groups the results by ObjectType.

Related Tests

• Test-MtAdDaclPrivilegedExtendedRightCount
• Test-MtAdDaclPrivilegedAllowAceDetails
• Test-MtAdDaclIdentityAceDistribution

Note: This test is LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use Invoke-Maester -IncludeLongRunning to run it.

Details

Every attribute of this check

Field	Value
Test ID	AD-DACL-12
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Permissions and delegation
Area	Privileged access
Resource type	Permission
MITRE ATT&CK	T1003.006 DCSync, T1098 Account Manipulation
PowerShell test	Test-MtAdDaclPrivilegedExtendedRightDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl
Long running	Yes

Source

• Test: tests/ad/dacl/Test.AD-DACL-12.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-12.md