AD-DACL-08: DACL ACE distribution per identity should be investigated
| ID | AD-DACL-08 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Access control |
| Resource type | Permission |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Knowing which identities appear most frequently in DACLs helps identify central delegation patterns, inherited administrative groups, and accounts that may have accumulated permissions over time.
- Hotspot Detection: Frequently occurring identities can represent broad administrative reach.
- Permission Hygiene: Distribution data helps distinguish expected administrative groups from unusual direct assignments.
- Operational Review: Repeated counts per identity make it easier to validate changes after cleanup or redesign.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review identities with unusually high ACE counts. Confirm they are expected administrative groups and not stale accounts, orphaned SIDs, or overly broad delegated principals.
How the Test Works
Section titled “How the Test Works”This test reads DaclEntries from Get-MtADDomainState, groups entries by IdentityReference, and reports the number of ACEs associated with each identity.
Related Tests
Section titled “Related Tests”Test-MtAdDaclDistinctIdentityCountTest-MtAdDaclPrivilegedAllowAceDetailsTest-MtAdDaclPrivilegedExtendedRightDetails
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.