AD-DACL-11: Privileged extended right count should be investigated


ID	`AD-DACL-11`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Permissions and delegation
Security area	Privileged access
Resource type	Permission
MITRE ATT&CK	T1003.006, T1098
Reads from	On-premises Active Directory

What this checks and how to fix it

Extended rights control specific privileged operations in Active Directory, such as sensitive control-access permissions tied to object classes or administrative workflows. Understanding how often they are delegated helps surface potentially risky permission models.

Sensitive Operations: Some extended rights can enable password resets, replication access, or other administrative actions.
Delegation Mapping: Counting these ACEs helps you understand how broadly control-access permissions are assigned.
Scope Awareness: Distinct ObjectType values show how granular or broad the delegation is.

Control Type

Operational

Security Recommendation

Review principals granted extended rights and verify that those delegations are necessary, documented, and limited to the smallest practical scope.

How the Test Works

This test reads DaclEntries from Get-MtADDomainState, filters to allow ACEs whose ActiveDirectoryRights includes ExtendedRight, and reports counts across identities, objects, and object types.

Test-MtAdDaclPrivilegedExtendedRightDetails
Test-MtAdDaclPrivilegedAllowAceCount
Test-MtAdDaclPrivilegedAllowAceDetails

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).