AD-DACL-17 - Inherited object type count should be investigated

Contributed by Michael SouleAll contributors →

Overview

Inherited object type GUIDs define which descendant object classes an inheritable ACE targets.

• Delegation scope visibility: Helps show how precisely ACE inheritance is scoped
• Privilege impact analysis: Broad inheritance can extend powerful rights to many child objects
• Configuration review: Distinct inherited object types reveal the variety of object classes affected by delegations

Control Type

Operational

Security Recommendation

• Review inherited ACEs that target sensitive descendant object classes
• Prefer precise scoping over overly broad inheritance where possible
• Validate that inheritance design matches your delegation model and administrative boundaries

How the Test Works

This test reads $adState.DaclEntries, filters for InheritedObjectType GUIDs that are not the all-zero default value, and counts the distinct GUIDs present.

Related Tests

• Test-MtAdDaclInheritedObjectTypeDetails - Provides a breakdown by inherited object type GUID
• Test-MtAdDaclNonInheritedAceCount - Counts ACEs that are explicitly assigned
• Test-MtAdDaclPrivilegedAllowAceDetails - Shows privileged allow authorizations in DACLs

Test Metadata

Field	Value
Test ID	AD-DACL-17
Severity	Info
Suite	Active Directory
Category	Active Directory - DACL
PowerShell test	Test-MtAdDaclInheritedObjectTypeCount
Services	ActiveDirectory
Tags	AD, AD-DACL-17, AD.DACL

Source

• Test: tests/ad/dacl/Test.AD-DACL-17.ps1
• Documentation: tests/ad/dacl/Test.AD-DACL-17.md