AD-DACL-04: Conflict object details should be investigated
| ID | AD-DACL-04 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Infrastructure hardening |
| Resource type | Tenant |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”High-level counts are useful, but remediation usually requires object-level detail. This test helps administrators pinpoint each conflict object present in the DACL dataset and understand how many ACEs are attached to it.
- Shows the exact conflict objects found in DACL analysis
- Supports cleanup validation by exposing object class and DN
- Quantifies ACE volume on each conflict object
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review each listed conflict object, confirm why it exists, and determine whether it is still needed. If an object is obsolete, validate dependencies and permissions before cleanup.
How the Test Works
Section titled “How the Test Works”This test retrieves $adState.DaclEntries, filters for entries whose ObjectDN contains CNF, groups them by object distinguished name, and returns each object with its class and ACE count.
Related Tests
Section titled “Related Tests”Test-MtAdDaclConflictObjectCountTest-MtAdDaclDenyAceDetailsTest-MtAdDaclOuObjectCount
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.