AD-DACL-16: Unresolved SID details should be investigated
| ID | AD-DACL-16 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Access control |
| Resource type | Permission |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Knowing which directory objects contain orphaned SID ACEs helps target cleanup work where it matters most.
- Object-focused remediation: Grouping unresolved SIDs by object shows exactly where stale ACEs exist
- Audit clarity: Makes manual DACL review easier during privileged access assessments
- Change tracking: Helps confirm whether decommissioned identities still linger on important objects
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Remove orphaned ACEs after confirming the referenced SID is no longer valid
- Prioritize cleanup on privileged OUs, admin groups, and delegation-heavy containers
- Document recurring sources of unresolved SIDs to improve identity lifecycle processes
How the Test Works
Section titled “How the Test Works”This test reads $adState.DaclEntries, filters unresolved IdentityReference values that begin with S-1-5-21, and groups them by ObjectDN.
Related Tests
Section titled “Related Tests”Test-MtAdDaclUnresolvedSidCount- Counts unresolved SID referencesTest-MtAdDaclNonInheritedAceCount- Counts explicit ACEs that may require reviewTest-MtAdDaclInheritedObjectTypeDetails- Shows inheritance targeting across ACEs
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.