AD-DACL-14: Non-inherited ACE count should be investigated
| ID | AD-DACL-14 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Permissions and delegation |
| Security area | Access control |
| Resource type | Permission |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Non-inherited ACEs represent explicit access assignments applied directly to directory objects.
- Custom delegation visibility: Explicit ACEs often reveal manual delegations and exceptions
- Misconfiguration detection: Direct permissions are more likely to diverge from baseline inheritance
- Review prioritization: Objects with many explicit ACEs deserve closer security review
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Review why explicit permissions were added instead of relying on inheritance
- Remove unnecessary one-off ACEs and standardize delegations where possible
- Pay special attention to explicit ACEs on privileged containers and administrative objects
How the Test Works
Section titled “How the Test Works”This test reads $adState.DaclEntries and counts entries where IsInherited is $false.
Related Tests
Section titled “Related Tests”Test-MtAdDaclDenyAceCount- Counts deny ACEs in DACLsTest-MtAdDaclPrivilegedAllowAceCount- Counts privileged allow authorizationsTest-MtAdDaclUnresolvedSidCount- Identifies stale SID references in ACEs
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.