AD-DACL-03: Conflict object count should be investigated
| ID | AD-DACL-03 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Infrastructure hardening |
| Resource type | Tenant |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Conflict objects with CNF markers typically originate from replication or naming conflicts. Even when old, they can indicate historical AD hygiene issues and should be understood before being ignored.
- Surfaces replication-conflict remnants in DACL analysis
- Helps identify cleanup candidates
- Provides context for unexpected objects appearing in permission reviews
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Investigate conflict objects and confirm whether they are expected remnants, still referenced, or safe to clean up. Review their permissions before remediation to understand any delegated access that may still exist.
How the Test Works
Section titled “How the Test Works”This test retrieves $adState.DaclEntries, searches for CNF within ObjectDN, deduplicates matching distinguished names, and reports the number of unique conflict objects and associated DACL entries.
Related Tests
Section titled “Related Tests”Test-MtAdDaclConflictObjectDetailsTest-MtAdDaclDistinctObjectCountTest-MtAdDaclDenyAceDetails
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.