Inherited object type details should be investigated
AD-DACL-18InfoActive DirectoryPermissions and delegation
Part of Active Directory · Active Directory · Permissions and delegation · All checks
Invoke-Maester -TestId AD-DACL-18Overview
Section titled “Overview”Inherited object type detail helps explain where inheritable ACEs are intended to apply.
- Scoping transparency: Reveals which descendant object classes are targeted most often
- Delegation review: Helps validate whether inherited permissions are narrowly or broadly applied
- Troubleshooting support: Useful when investigating unexpected effective permissions on child objects
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Review heavily used inherited object type targets for overly broad delegations
- Confirm that inherited ACE scope matches intended administrative boundaries
- Reassess inherited rights on sensitive containers if descendant object targeting is not well understood
How the Test Works
Section titled “How the Test Works”This test reads $adState.DaclEntries, filters out the all-zero InheritedObjectType value, and groups the remaining ACEs by inherited object type GUID.
Related Tests
Section titled “Related Tests”Test-MtAdDaclInheritedObjectTypeCount- Counts distinct inherited object type GUIDsTest-MtAdDaclPrivilegedExtendedRightIdentity- Shows identities with privileged extended rightsTest-MtAdDaclUnresolvedSidDetails- Lists objects containing orphaned SID ACEs
Note: This test is
LongRunning. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. UseInvoke-Maester -IncludeLongRunningto run it.
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DACL-18 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Area | Access control |
| Resource type | Permission |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdDaclInheritedObjectTypeDetails |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
| Long running | Yes |
Source
Section titled “Source”- Test:
tests/ad/dacl/Test.AD-DACL-18.ps1 - Documentation:
tests/ad/dacl/Test.AD-DACL-18.md