AD-DACL-13: Privileged extended right identities should be investigated


ID	`AD-DACL-13`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Permissions and delegation
Security area	Privileged access
Resource type	Permission
MITRE ATT&CK	T1003.006, T1098
Reads from	On-premises Active Directory

What this checks and how to fix it

Privileged extended rights in Active Directory can authorize sensitive operations that go beyond standard read or write permissions.

Privilege escalation risk: Rights such as password reset or replication access can enable takeover paths
Delegation review: Extended rights are often assigned during admin delegation and may persist longer than intended
Exposure visibility: Grouping by identity shows which principals hold high-impact rights across the directory

Control Type

Operational

Security Recommendation

Review every identity granted privileged extended rights
Confirm the assignment is documented, approved, and still required
Remove stale delegations, especially for replication and password-management rights

How the Test Works

This test reads $adState.DaclEntries, filters for allow ACEs with ActiveDirectoryRights = ExtendedRight, matches them to a set of privileged extended right GUIDs, and groups the results by IdentityReference.

Test-MtAdDaclPrivilegedExtendedRightCount - Counts privileged extended rights in use
Test-MtAdDaclPrivilegedExtendedRightDetails - Breaks down privileged extended rights by type
Test-MtAdDaclNonInheritedAceCount - Counts explicit DACL entries that may represent custom delegations

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).