Skip to main content
Version: 2.2.1-preview

AD-DACL-14 - Non-inherited ACE count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Non-inherited ACEs represent explicit access assignments applied directly to directory objects.

  • Custom delegation visibility: Explicit ACEs often reveal manual delegations and exceptions
  • Misconfiguration detection: Direct permissions are more likely to diverge from baseline inheritance
  • Review prioritization: Objects with many explicit ACEs deserve closer security review

Security Recommendation​

  • Review why explicit permissions were added instead of relying on inheritance
  • Remove unnecessary one-off ACEs and standardize delegations where possible
  • Pay special attention to explicit ACEs on privileged containers and administrative objects

How the Test Works​

This test reads $adState.DaclEntries and counts entries where IsInherited is $false.

  • Test-MtAdDaclDenyAceCount - Counts deny ACEs in DACLs
  • Test-MtAdDaclPrivilegedAllowAceCount - Counts privileged allow authorizations
  • Test-MtAdDaclUnresolvedSidCount - Identifies stale SID references in ACEs

Test Metadata​

FieldValue
Test IDAD-DACL-14
SeverityInfo
SuiteActive Directory
CategoryAD.DACL
PowerShell testTest-MtAdDaclNonInheritedAceCount
TagsAD, AD-DACL-14, AD.DACL

Source​

  • Pester test: tests/ad/dacl/Test-MtAdDaclNonInheritedAceCount.Tests.ps1
  • PowerShell source: powershell/public/ad/dacl/Test-MtAdDaclNonInheritedAceCount.ps1