Inherited object type count should be investigated
AD-DACL-17InfoActive DirectoryPermissions and delegation
Part of Active Directory · Active Directory · Permissions and delegation · All checks
Invoke-Maester -TestId AD-DACL-17Overview
Section titled “Overview”Inherited object type GUIDs define which descendant object classes an inheritable ACE targets.
- Delegation scope visibility: Helps show how precisely ACE inheritance is scoped
- Privilege impact analysis: Broad inheritance can extend powerful rights to many child objects
- Configuration review: Distinct inherited object types reveal the variety of object classes affected by delegations
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Review inherited ACEs that target sensitive descendant object classes
- Prefer precise scoping over overly broad inheritance where possible
- Validate that inheritance design matches your delegation model and administrative boundaries
How the Test Works
Section titled “How the Test Works”This test reads $adState.DaclEntries, filters for InheritedObjectType GUIDs that are not the all-zero default value, and counts the distinct GUIDs present.
Related Tests
Section titled “Related Tests”Test-MtAdDaclInheritedObjectTypeDetails- Provides a breakdown by inherited object type GUIDTest-MtAdDaclNonInheritedAceCount- Counts ACEs that are explicitly assignedTest-MtAdDaclPrivilegedAllowAceDetails- Shows privileged allow authorizations in DACLs
Note: This test is
LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. UseInvoke-Maester -IncludeLongRunningto run it.
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DACL-17 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Area | Access control |
| Resource type | Permission |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdDaclInheritedObjectTypeCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
| Long running | Yes |
Source
Section titled “Source”- Test:
tests/ad/dacl/Test.AD-DACL-17.ps1 - Documentation:
tests/ad/dacl/Test.AD-DACL-17.md