AD-DACL-02: OU DACL entry count should be investigated
| ID | AD-DACL-02 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Access control |
| Resource type | OrganizationalUnit |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Organizational Units are a common delegation boundary in Active Directory. Understanding how many DACL entries apply to OU objects helps focus permission review on objects that commonly control administration and policy scoping.
- Highlights OU permission surface area
- Supports delegation review for administrative boundaries
- Provides context for OU-focused DACL investigations
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review OU permissions regularly, especially where OUs host privileged users, servers, or administrative delegation models. Unexpectedly large or complex OU ACLs can indicate legacy delegation that should be validated.
How the Test Works
Section titled “How the Test Works”This test retrieves $adState.DaclEntries, filters entries where ObjectClass equals organizationalUnit, and reports the count of OU DACL entries and distinct OU objects represented.
Related Tests
Section titled “Related Tests”Test-MtAdDaclDistinctObjectCountTest-MtAdDaclDenyAceCountTest-MtAdDaclDenyAceDetails
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.