# OU DACL entry count should be investigated

Organizational Units are a common delegation boundary in Active Directory.

Source: https://maester.dev/docs/tests/AD-DACL-02

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Permissions and delegation · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-DACL-02
```

## Overview

Organizational Units are a common delegation boundary in Active Directory. Understanding how many DACL entries apply to OU objects helps focus permission review on objects that commonly control administration and policy scoping.

- **Highlights OU permission surface area**
- **Supports delegation review** for administrative boundaries
- **Provides context** for OU-focused DACL investigations

#### Control Type

**Operational**

#### Security Recommendation

Review OU permissions regularly, especially where OUs host privileged users, servers, or administrative delegation models. Unexpectedly large or complex OU ACLs can indicate legacy delegation that should be validated.

#### How the Test Works

This test retrieves `$adState.DaclEntries`, filters entries where `ObjectClass` equals `organizationalUnit`, and reports the count of OU DACL entries and distinct OU objects represented.

#### Related Tests

- `Test-MtAdDaclDistinctObjectCount`
- `Test-MtAdDaclDenyAceCount`
- `Test-MtAdDaclDenyAceDetails`

> **Note:** This test is `LongRunning`. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use `Invoke-Maester -IncludeLongRunning` to run it.

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-DACL-02 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Area | Access control |
| Resource type | OrganizationalUnit |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdDaclOuObjectCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-02.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
| Long running | Yes |

</details>

## Source

- Test: [`tests/ad/dacl/Test.AD-DACL-02.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-02.ps1)
- Documentation: [`tests/ad/dacl/Test.AD-DACL-02.md`](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-02.md)