# Deny ACE count should be investigated

Deny ACEs are powerful because they can override allow permissions and create access outcomes that are difficult to troubleshoot.

Source: https://maester.dev/docs/tests/AD-DACL-05

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Permissions and delegation · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-DACL-05
```

## Overview

Deny ACEs are powerful because they can override allow permissions and create access outcomes that are difficult to troubleshoot. Counting them provides a quick baseline for how much explicit denial logic exists in the collected AD permission set.

- **Highlights explicit deny usage** in AD DACLs
- **Supports troubleshooting** for delegation and access issues
- **Helps prioritize deeper review** when deny ACE volume is high

#### Control Type

**Operational**

#### Security Recommendation

Review deny ACE usage carefully. Ensure each deny entry is intentional, documented, and still required. Excessive or poorly understood deny entries can create administrative confusion and mask broader permission issues.

#### How the Test Works

This test retrieves `$adState.DaclEntries`, filters entries where `AccessControlType` contains `Deny`, and reports the total deny ACE count along with the number of affected objects.

#### Related Tests

- `Test-MtAdDaclDenyAceDetails`
- `Test-MtAdDaclDistinctObjectCount`
- `Test-MtAdDaclOuObjectCount`

> **Note:** This test is `LongRunning`. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use `Invoke-Maester -IncludeLongRunning` to run it.

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-DACL-05 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Area | Access control |
| Resource type | Permission |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdDaclDenyAceCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-05.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
| Long running | Yes |

</details>

## Source

- Test: [`tests/ad/dacl/Test.AD-DACL-05.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-05.ps1)
- Documentation: [`tests/ad/dacl/Test.AD-DACL-05.md`](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-05.md)