AD-DACL-07: Distinct DACL identity count should be investigated
| ID | AD-DACL-07 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Access control |
| Resource type | Permission |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Every DACL ACE references a security principal. Tracking the number of distinct identities appearing in delegated permissions helps you understand how widely access has been spread across the directory.
- Delegation Visibility: A large number of distinct identities can indicate broad or inconsistent delegation.
- Review Prioritization: Security teams can focus on identities that appear repeatedly across sensitive objects.
- Baseline Tracking: Repeated measurement makes it easier to spot growth in delegated access over time.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Keep delegation models simple and intentional. Prefer group-based administration over direct assignment to many individual accounts or SIDs.
How the Test Works
Section titled “How the Test Works”This test reads DaclEntries from Get-MtADDomainState, extracts unique IdentityReference values, and reports how many distinct identities appear across all collected ACEs.
Related Tests
Section titled “Related Tests”Test-MtAdDaclIdentityAceDistributionTest-MtAdDaclPrivilegedAllowAceCountTest-MtAdDaclPrivilegedExtendedRightCount
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.