AD-DACL-01: Distinct DACL object count should be investigated
| ID | AD-DACL-01 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Access control |
| Resource type | Permission |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Knowing how many distinct Active Directory objects are represented in the collected DACL dataset helps establish the scope of permission analysis.
- Measures DACL coverage across collected directory objects
- Provides a baseline for comparing later DACL metrics
- Helps validate collection breadth when reviewing AD permission visibility
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Use this count as a baseline metric when reviewing DACL analysis. Unexpectedly low counts can indicate collection gaps, limited visibility, or an unexpectedly small review scope.
How the Test Works
Section titled “How the Test Works”This test retrieves $adState.DaclEntries, extracts the ObjectDN value from each entry, deduplicates the object list, and reports the total number of unique objects with DACL entries.
Related Tests
Section titled “Related Tests”Test-MtAdDaclOuObjectCountTest-MtAdDaclConflictObjectCountTest-MtAdDaclDenyAceCount
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.