AD-DACL-12: Privileged extended right details should be investigated
| ID | AD-DACL-12 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Privileged access |
| Resource type | Permission |
| MITRE ATT&CK | T1003.006, T1098 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Extended rights are most useful when you can see which specific ObjectType values are being delegated. Grouping ACEs by GUID reveals whether permissions are narrowly targeted or broadly applied.
- GUID-Level Visibility: Highlights which extended-right object types occur most often.
- Delegation Review: Helps correlate control-access permissions with documented administration patterns.
- Change Tracking: Makes it easier to compare extended-right usage over time.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Document the purpose of delegated extended rights and review object types with high counts or unexpected identity coverage.
How the Test Works
Section titled “How the Test Works”This test reads DaclEntries from Get-MtADDomainState, filters to allow ACEs containing ExtendedRight, normalizes missing ObjectType values, and groups the results by ObjectType.
Related Tests
Section titled “Related Tests”Test-MtAdDaclPrivilegedExtendedRightCountTest-MtAdDaclPrivilegedAllowAceDetailsTest-MtAdDaclIdentityAceDistribution
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.