AD-DACL-13 - Privileged extended right identities should be investigated

Contributed by Michael SouleAll contributors →

Overview

Privileged extended rights in Active Directory can authorize sensitive operations that go beyond standard read or write permissions.

• Privilege escalation risk: Rights such as password reset or replication access can enable takeover paths
• Delegation review: Extended rights are often assigned during admin delegation and may persist longer than intended
• Exposure visibility: Grouping by identity shows which principals hold high-impact rights across the directory

Control Type

Operational

Security Recommendation

• Review every identity granted privileged extended rights
• Confirm the assignment is documented, approved, and still required
• Remove stale delegations, especially for replication and password-management rights

How the Test Works

This test reads $adState.DaclEntries, filters for allow ACEs with ActiveDirectoryRights = ExtendedRight, matches them to a set of privileged extended right GUIDs, and groups the results by IdentityReference.

Related Tests

• Test-MtAdDaclPrivilegedExtendedRightCount - Counts privileged extended rights in use
• Test-MtAdDaclPrivilegedExtendedRightDetails - Breaks down privileged extended rights by type
• Test-MtAdDaclNonInheritedAceCount - Counts explicit DACL entries that may represent custom delegations

Test Metadata

Field	Value
Test ID	AD-DACL-13
Severity	Info
Suite	Active Directory
Category	Active Directory - DACL
PowerShell test	Test-MtAdDaclPrivilegedExtendedRightIdentity
Services	ActiveDirectory
Tags	AD, AD-DACL-13, AD.DACL

Source

• Test: tests/ad/dacl/Test.AD-DACL-13.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-13.md