AD-DACL-10: Privileged allow ACE details should be investigated
| ID | AD-DACL-10 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Privileged access |
| Resource type | Permission |
| MITRE ATT&CK | T1098, T1222.001 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”A count alone does not show where powerful ACEs are applied. Grouping privileged allow ACEs by object helps identify high-value directory objects that carry sensitive delegated rights.
- Object-Centric Review: Highlights which objects hold the most powerful ACEs.
- Delegation Validation: Makes it easier to confirm whether privileged rights are intentional.
- Attack Path Awareness: Sensitive permissions on administrative objects can enable escalation.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review objects with privileged allow ACEs and confirm the assigned identities and rights are justified. Reduce direct assignments where possible and prefer auditable group-based delegation.
How the Test Works
Section titled “How the Test Works”This test reads DaclEntries from Get-MtADDomainState, filters to allow ACEs containing GenericAll, WriteDacl, WriteOwner, or ExtendedRight, and groups the results by object.
Related Tests
Section titled “Related Tests”Test-MtAdDaclPrivilegedAllowAceCountTest-MtAdDaclIdentityAceDistributionTest-MtAdDaclPrivilegedExtendedRightDetails
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.