# Conflict object count should be investigated

Conflict objects with CNF markers typically originate from replication or naming conflicts.

Source: https://maester.dev/docs/tests/AD-DACL-03

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Permissions and delegation · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-DACL-03
```

## Overview

Conflict objects with `CNF` markers typically originate from replication or naming conflicts. Even when old, they can indicate historical AD hygiene issues and should be understood before being ignored.

- **Surfaces replication-conflict remnants** in DACL analysis
- **Helps identify cleanup candidates**
- **Provides context** for unexpected objects appearing in permission reviews

#### Control Type

**Operational**

#### Security Recommendation

Investigate conflict objects and confirm whether they are expected remnants, still referenced, or safe to clean up. Review their permissions before remediation to understand any delegated access that may still exist.

#### How the Test Works

This test retrieves `$adState.DaclEntries`, searches for `CNF` within `ObjectDN`, deduplicates matching distinguished names, and reports the number of unique conflict objects and associated DACL entries.

#### Related Tests

- `Test-MtAdDaclConflictObjectDetails`
- `Test-MtAdDaclDistinctObjectCount`
- `Test-MtAdDaclDenyAceDetails`

> **Note:** This test is `LongRunning`. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use `Invoke-Maester -IncludeLongRunning` to run it.

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-DACL-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdDaclConflictObjectCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-03.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
| Long running | Yes |

</details>

## Source

- Test: [`tests/ad/dacl/Test.AD-DACL-03.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-03.ps1)
- Documentation: [`tests/ad/dacl/Test.AD-DACL-03.md`](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-03.md)