AD-DACL-18: Inherited object type details should be investigated
| ID | AD-DACL-18 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Access control |
| Resource type | Permission |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Inherited object type detail helps explain where inheritable ACEs are intended to apply.
- Scoping transparency: Reveals which descendant object classes are targeted most often
- Delegation review: Helps validate whether inherited permissions are narrowly or broadly applied
- Troubleshooting support: Useful when investigating unexpected effective permissions on child objects
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Review heavily used inherited object type targets for overly broad delegations
- Confirm that inherited ACE scope matches intended administrative boundaries
- Reassess inherited rights on sensitive containers if descendant object targeting is not well understood
How the Test Works
Section titled “How the Test Works”This test reads $adState.DaclEntries, filters out the all-zero InheritedObjectType value, and groups the remaining ACEs by inherited object type GUID.
Related Tests
Section titled “Related Tests”Test-MtAdDaclInheritedObjectTypeCount- Counts distinct inherited object type GUIDsTest-MtAdDaclPrivilegedExtendedRightIdentity- Shows identities with privileged extended rightsTest-MtAdDaclUnresolvedSidDetails- Lists objects containing orphaned SID ACEs
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.