Contributed by Michael SouleAll contributors →
Part of Active Directory · Active Directory · Permissions and delegation · All checks
```powershell title="Run this check" Invoke-Maester -TestId AD-DACL-17 ``` ## Overview Inherited object type GUIDs define which descendant object classes an inheritable ACE targets. - **Delegation scope visibility**: Helps show how precisely ACE inheritance is scoped - **Privilege impact analysis**: Broad inheritance can extend powerful rights to many child objects - **Configuration review**: Distinct inherited object types reveal the variety of object classes affected by delegations #### Control Type **Operational** #### Security Recommendation - Review inherited ACEs that target sensitive descendant object classes - Prefer precise scoping over overly broad inheritance where possible - Validate that inheritance design matches your delegation model and administrative boundaries #### How the Test Works This test reads `$adState.DaclEntries`, filters for `InheritedObjectType` GUIDs that are not the all-zero default value, and counts the distinct GUIDs present. #### Related Tests - `Test-MtAdDaclInheritedObjectTypeDetails` - Provides a breakdown by inherited object type GUID - `Test-MtAdDaclNonInheritedAceCount` - Counts ACEs that are explicitly assigned - `Test-MtAdDaclPrivilegedAllowAceDetails` - Shows privileged allow authorizations in DACLs > **Note:** This test is `LongRunning`. It loads the full DACL dataset, which can consume significant memory in large Active Directory environments. Use `Invoke-Maester -IncludeLongRunning` to run it. ## Details