# Deny ACE details should be investigated

When deny ACEs exist, administrators need to know exactly which identities are denied on which objects.

Source: https://maester.dev/docs/tests/AD-DACL-06

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Permissions and delegation · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-DACL-06
```

## Overview

When deny ACEs exist, administrators need to know exactly which identities are denied on which objects. Grouping deny ACEs by object and identity makes it easier to review intent and spot concentrated or unusual deny patterns.

- **Maps denied principals to specific objects**
- **Supports delegated access reviews**
- **Helps identify concentrated deny patterns** that deserve validation

#### Control Type

**Operational**

#### Security Recommendation

Review each deny ACE grouping to confirm it reflects an intentional control. Focus especially on privileged objects, administrative groups, and OUs used for delegation.

#### How the Test Works

This test retrieves `$adState.DaclEntries`, filters entries where `AccessControlType` contains `Deny`, groups results by `ObjectDN` and `IdentityReference`, and reports the count of deny ACEs for each combination.

#### Related Tests

- `Test-MtAdDaclDenyAceCount`
- `Test-MtAdDaclConflictObjectDetails`
- `Test-MtAdDaclOuObjectCount`

> **Note:** This test is `LongRunning`. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use `Invoke-Maester -IncludeLongRunning` to run it.

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-DACL-06 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Area | Access control |
| Resource type | Permission |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdDaclDenyAceDetails](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-06.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
| Long running | Yes |

</details>

## Source

- Test: [`tests/ad/dacl/Test.AD-DACL-06.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-06.ps1)
- Documentation: [`tests/ad/dacl/Test.AD-DACL-06.md`](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-06.md)