Privileged extended right identities should be investigated
AD-DACL-13InfoActive DirectoryPermissions and delegation
Part of Active Directory · Active Directory · Permissions and delegation · All checks
Invoke-Maester -TestId AD-DACL-13Overview
Section titled “Overview”Privileged extended rights in Active Directory can authorize sensitive operations that go beyond standard read or write permissions.
- Privilege escalation risk: Rights such as password reset or replication access can enable takeover paths
- Delegation review: Extended rights are often assigned during admin delegation and may persist longer than intended
- Exposure visibility: Grouping by identity shows which principals hold high-impact rights across the directory
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Review every identity granted privileged extended rights
- Confirm the assignment is documented, approved, and still required
- Remove stale delegations, especially for replication and password-management rights
How the Test Works
Section titled “How the Test Works”This test reads $adState.DaclEntries, filters for allow ACEs with ActiveDirectoryRights = ExtendedRight, matches them to a set of privileged extended right GUIDs, and groups the results by IdentityReference.
Related Tests
Section titled “Related Tests”Test-MtAdDaclPrivilegedExtendedRightCount- Counts privileged extended rights in useTest-MtAdDaclPrivilegedExtendedRightDetails- Breaks down privileged extended rights by typeTest-MtAdDaclNonInheritedAceCount- Counts explicit DACL entries that may represent custom delegations
Note: This test is
LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. UseInvoke-Maester -IncludeLongRunningto run it.
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DACL-13 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Area | Privileged access |
| Resource type | Permission |
| MITRE ATT&CK | T1003.006 DCSync, T1098 Account Manipulation |
| PowerShell test | Test-MtAdDaclPrivilegedExtendedRightIdentity |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
| Long running | Yes |
Source
Section titled “Source”- Test:
tests/ad/dacl/Test.AD-DACL-13.ps1 - Documentation:
tests/ad/dacl/Test.AD-DACL-13.md