AD-DACL-09 - Privileged allow ACE count should be investigated

Contributed by Michael SouleAll contributors →

Overview

Allow ACEs that grant GenericAll, WriteDacl, WriteOwner, or ExtendedRight can enable high-impact control over Active Directory objects. These permissions are commonly involved in privilege escalation and persistence paths.

• GenericAll: Grants broad control over the object.
• WriteDacl / WriteOwner: Enables permission tampering or ownership takeover.
• ExtendedRight: May allow sensitive control-access operations depending on object type.

Control Type

Operational

Security Recommendation

Limit privileged rights to tightly controlled administrative groups. Investigate unexpected identities or objects that accumulate these permissions.

How the Test Works

This test reads DaclEntries from Get-MtADDomainState, filters to allow ACEs, and counts entries where ActiveDirectoryRights includes GenericAll, WriteDacl, WriteOwner, or ExtendedRight.

Related Tests

• Test-MtAdDaclPrivilegedAllowAceDetails
• Test-MtAdDaclPrivilegedExtendedRightCount
• Test-MtAdDaclDistinctIdentityCount

Test Metadata

Field	Value
Test ID	AD-DACL-09
Severity	Info
Suite	Active Directory
Category	Active Directory - DACL
PowerShell test	Test-MtAdDaclPrivilegedAllowAceCount
Services	ActiveDirectory
Tags	AD, AD-DACL-09, AD.DACL

Source

• Test: tests/ad/dacl/Test.AD-DACL-09.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-09.md