Non-inherited ACE count should be investigated

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Permissions and delegation · All checks

Run this check

Invoke-Maester -TestId AD-DACL-14

Overview

Non-inherited ACEs represent explicit access assignments applied directly to directory objects.

• Custom delegation visibility: Explicit ACEs often reveal manual delegations and exceptions
• Misconfiguration detection: Direct permissions are more likely to diverge from baseline inheritance
• Review prioritization: Objects with many explicit ACEs deserve closer security review

Control Type

Operational

Security Recommendation

• Review why explicit permissions were added instead of relying on inheritance
• Remove unnecessary one-off ACEs and standardize delegations where possible
• Pay special attention to explicit ACEs on privileged containers and administrative objects

How the Test Works

This test reads $adState.DaclEntries and counts entries where IsInherited is $false.

Related Tests

• Test-MtAdDaclDenyAceCount - Counts deny ACEs in DACLs
• Test-MtAdDaclPrivilegedAllowAceCount - Counts privileged allow authorizations
• Test-MtAdDaclUnresolvedSidCount - Identifies stale SID references in ACEs

Note: This test is LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use Invoke-Maester -IncludeLongRunning to run it.

Details

Every attribute of this check

Field	Value
Test ID	AD-DACL-14
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Permissions and delegation
Area	Access control
Resource type	Permission
MITRE ATT&CK	None
PowerShell test	Test-MtAdDaclNonInheritedAceCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl
Long running	Yes

Source

• Test: tests/ad/dacl/Test.AD-DACL-14.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-14.md