AD-DACL-06: Deny ACE details should be investigated
| ID | AD-DACL-06 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Access control |
| Resource type | Permission |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”When deny ACEs exist, administrators need to know exactly which identities are denied on which objects. Grouping deny ACEs by object and identity makes it easier to review intent and spot concentrated or unusual deny patterns.
- Maps denied principals to specific objects
- Supports delegated access reviews
- Helps identify concentrated deny patterns that deserve validation
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review each deny ACE grouping to confirm it reflects an intentional control. Focus especially on privileged objects, administrative groups, and OUs used for delegation.
How the Test Works
Section titled “How the Test Works”This test retrieves $adState.DaclEntries, filters entries where AccessControlType contains Deny, groups results by ObjectDN and IdentityReference, and reports the count of deny ACEs for each combination.
Related Tests
Section titled “Related Tests”Test-MtAdDaclDenyAceCountTest-MtAdDaclConflictObjectDetailsTest-MtAdDaclOuObjectCount
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.