AD-DACL-05: Deny ACE count should be investigated
| ID | AD-DACL-05 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Access control |
| Resource type | Permission |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Deny ACEs are powerful because they can override allow permissions and create access outcomes that are difficult to troubleshoot. Counting them provides a quick baseline for how much explicit denial logic exists in the collected AD permission set.
- Highlights explicit deny usage in AD DACLs
- Supports troubleshooting for delegation and access issues
- Helps prioritize deeper review when deny ACE volume is high
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review deny ACE usage carefully. Ensure each deny entry is intentional, documented, and still required. Excessive or poorly understood deny entries can create administrative confusion and mask broader permission issues.
How the Test Works
Section titled “How the Test Works”This test retrieves $adState.DaclEntries, filters entries where AccessControlType contains Deny, and reports the total deny ACE count along with the number of affected objects.
Related Tests
Section titled “Related Tests”Test-MtAdDaclDenyAceDetailsTest-MtAdDaclDistinctObjectCountTest-MtAdDaclOuObjectCount
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.