AD-DACL-09: Privileged allow ACE count should be investigated
| ID | AD-DACL-09 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Privileged access |
| Resource type | Permission |
| MITRE ATT&CK | T1098, T1222.001 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Allow ACEs that grant GenericAll, WriteDacl, WriteOwner, or ExtendedRight can enable high-impact control over Active Directory objects. These permissions are commonly involved in privilege escalation and persistence paths.
- GenericAll: Grants broad control over the object.
- WriteDacl / WriteOwner: Enables permission tampering or ownership takeover.
- ExtendedRight: May allow sensitive control-access operations depending on object type.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Limit privileged rights to tightly controlled administrative groups. Investigate unexpected identities or objects that accumulate these permissions.
How the Test Works
Section titled “How the Test Works”This test reads DaclEntries from Get-MtADDomainState, filters to allow ACEs, and counts entries where ActiveDirectoryRights includes GenericAll, WriteDacl, WriteOwner, or ExtendedRight.
Related Tests
Section titled “Related Tests”Test-MtAdDaclPrivilegedAllowAceDetailsTest-MtAdDaclPrivilegedExtendedRightCountTest-MtAdDaclDistinctIdentityCount
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.