merill · Oct 30, 2026 · Oct 30, 2026
@@ -62,6 +62,7 @@ This test retrieves the environment’s configured tombstone lifetime value from
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdTombstoneLifetimeConfig](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-01.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -65,6 +65,7 @@ This test queries AD configuration for the dSHeuristics setting(s) and reports a
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdDsHeuristicsCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-02.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -60,6 +60,7 @@ This test inspects the SPN mapping configuration exposed by AD, extracts the con
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdSpnMappings](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-03.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -63,6 +63,7 @@ This test retrieves the set of enabled AD optional feature flags and reports the
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdOptionalFeaturesCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-04.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:msDS-OptionalFeature:ReadProperty |
 
 ## Source
 

@@ -62,6 +62,7 @@ This test enumerates AD partitions/paths and reports which ones have Recycle Bin
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdRecycleBinEnabledPaths](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-05.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:msDS-OptionalFeature:ReadProperty |
 
 ## Source
 

@@ -62,6 +62,7 @@ This test reads LDAP query policy configuration from AD and produces a count/vis
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdLdapQueryPolicyCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-06.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -62,6 +62,7 @@ This test retrieves the default LDAP query policy values and reports them as an
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdDefaultQueryPolicy](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-07.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -62,6 +62,7 @@ This test inspects AD authentication policy configuration and reports a count/vi
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdAuthNPolicyConfigCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-08.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -60,6 +60,7 @@ AD-based activation objects are used by Windows for volume activation and relate
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdAdActivationObjectsCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-09.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -60,6 +60,7 @@ Well-known security principals are built-in identities with special meaning in A
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdWellKnownSecurityPrincipalsCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-10.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -60,6 +60,7 @@ DHCP servers registered in Active Directory are authorized to provide IP address
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdRegisteredDhcpServersCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-11.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -61,6 +61,7 @@ Enterprise Certification Authorities (CAs) issue certificates for domain authent
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdEnterpriseCaCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-12.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -60,6 +60,7 @@ Certificate templates define which certificate types can be issued and under wha
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdCertificateTemplatesCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-13.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -60,6 +60,7 @@ Enrollment templates represent which certificate templates are available for use
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdEnrollmentTemplatesCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-14.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -60,6 +60,7 @@ Enrollment-capable CA certificates include validity periods and other critical p
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdEnrollmentCaCertificateDetails](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-15.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -60,6 +60,7 @@ Trusted root CAs act as the trust anchors for an entire PKI trust chain. If an a
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdTrustedRootCaCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-16.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -61,6 +61,7 @@ The test enumerates trusted root CA certificates configured for AD (or in the mo
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdTrustedRootCaDetails](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-17.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -63,6 +63,7 @@ The test queries AD configuration for intermediate CA entries and returns the nu
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdIntermediateCaCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-18.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -61,6 +61,7 @@ The test enumerates intermediate CA certificates in the AD configuration context
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdIntermediateCaDetails](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-19.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -59,6 +59,7 @@ The test inspects AD configuration for CRL distribution point entries, counts th
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdCrlDistributionPointsCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-20.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -59,6 +59,7 @@ The test queries the AD NTAuth certificate container, counts the number of confi
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdNtAuthCertificatesCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-21.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -68,6 +68,7 @@ The test enumerates KDS root keys present in Active Directory and evaluates the
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdKdsRootKeysCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-22.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -59,6 +59,7 @@ The test queries AD site link configuration entries that use SMTP as the replica
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdSmtpSiteLinksCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-23.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -62,6 +62,7 @@ The test queries AD site link configuration entries using IP as the replication
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdIpSiteLinksCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-24.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
 
 ## Source
 

@@ -68,6 +68,7 @@ The test returns informational results to help you assess the scope of disabled
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdComputerDisabledCount](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-01.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
 
 ## Source
 

@@ -71,6 +71,7 @@ The default 90-day threshold is a common security baseline. Set `DormantThreshol
 | MITRE ATT&CK | T1078.002 Domain Accounts |
 | PowerShell test | [Test-MtAdComputerDormantCount](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-02.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
 
 ## Source
 

@@ -71,6 +71,7 @@ Note: Not all computer accounts will have this attribute, depending on how they
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdComputerCreatorSidCount](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-03.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
 
 ## Source
 

@@ -71,6 +71,7 @@ This test examines the `primaryGroupId` attribute of all enabled computer accoun
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdComputerNonStandardGroup](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-04.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
 
 ## Source
 

@@ -71,6 +71,7 @@ This test counts computer objects where the `SIDHistory` attribute is populated.
 | MITRE ATT&CK | T1134.005 SID-History Injection |
 | PowerShell test | [Test-MtAdComputerSidHistoryCount](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-05.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
 
 ## Source
 

@@ -69,6 +69,7 @@ This test identifies enabled computer accounts where the Distinguished Name cont
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdComputerInDefaultContainer](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-06.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
 
 ## Source
 

@@ -71,6 +71,7 @@ This test analyzes all enabled computer accounts and counts the distinct organiz
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdComputerOUCount](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-07.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
 
 ## Source
 

@@ -75,6 +75,7 @@ This test groups all enabled computers by their parent container and calculates:
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdComputerPerOUAverage](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-08.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
 
 ## Source
 

@@ -70,6 +70,7 @@ This test counts computers with different delegation configurations:
 | MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket |
 | PowerShell test | [Test-MtAdComputerDelegationCount](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-09.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
 
 ## Source
 

@@ -75,6 +75,7 @@ This test provides a detailed breakdown of:
 | MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket |
 | PowerShell test | [Test-MtAdComputerDelegationDetails](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-10.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
 
 ## Source
 

@@ -65,6 +65,7 @@ This test retrieves `$adState.DaclEntries`, extracts the `ObjectDN` value from e
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdDaclDistinctObjectCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-01.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -65,6 +65,7 @@ This test retrieves `$adState.DaclEntries`, filters entries where `ObjectClass`
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdDaclOuObjectCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-02.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -65,6 +65,7 @@ This test retrieves `$adState.DaclEntries`, searches for `CNF` within `ObjectDN`
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdDaclConflictObjectCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-03.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -65,6 +65,7 @@ This test retrieves `$adState.DaclEntries`, filters for entries whose `ObjectDN`
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdDaclConflictObjectDetails](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-04.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -65,6 +65,7 @@ This test retrieves `$adState.DaclEntries`, filters entries where `AccessControl
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdDaclDenyAceCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-05.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -65,6 +65,7 @@ This test retrieves `$adState.DaclEntries`, filters entries where `AccessControl
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdDaclDenyAceDetails](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-06.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -65,6 +65,7 @@ This test reads `DaclEntries` from `Get-MtADDomainState`, extracts unique `Ident
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdDaclDistinctIdentityCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-07.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -65,6 +65,7 @@ This test reads `DaclEntries` from `Get-MtADDomainState`, groups entries by `Ide
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdDaclIdentityAceDistribution](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-08.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -65,6 +65,7 @@ This test reads `DaclEntries` from `Get-MtADDomainState`, filters to allow ACEs,
 | MITRE ATT&CK | T1098 Account Manipulation, T1222.001 Windows Permissions |
 | PowerShell test | [Test-MtAdDaclPrivilegedAllowAceCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-09.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -65,6 +65,7 @@ This test reads `DaclEntries` from `Get-MtADDomainState`, filters to allow ACEs
 | MITRE ATT&CK | T1098 Account Manipulation, T1222.001 Windows Permissions |
 | PowerShell test | [Test-MtAdDaclPrivilegedAllowAceDetails](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-10.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -65,6 +65,7 @@ This test reads `DaclEntries` from `Get-MtADDomainState`, filters to allow ACEs
 | MITRE ATT&CK | T1003.006 DCSync, T1098 Account Manipulation |
 | PowerShell test | [Test-MtAdDaclPrivilegedExtendedRightCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-11.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -65,6 +65,7 @@ This test reads `DaclEntries` from `Get-MtADDomainState`, filters to allow ACEs
 | MITRE ATT&CK | T1003.006 DCSync, T1098 Account Manipulation |
 | PowerShell test | [Test-MtAdDaclPrivilegedExtendedRightDetails](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-12.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -67,6 +67,7 @@ This test reads `$adState.DaclEntries`, filters for allow ACEs with `ActiveDirec
 | MITRE ATT&CK | T1003.006 DCSync, T1098 Account Manipulation |
 | PowerShell test | [Test-MtAdDaclPrivilegedExtendedRightIdentity](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-13.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -67,6 +67,7 @@ This test reads `$adState.DaclEntries` and counts entries where `IsInherited` is
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdDaclNonInheritedAceCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-14.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -67,6 +67,7 @@ This test reads `$adState.DaclEntries` and looks for entries whose `IdentityRefe
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdDaclUnresolvedSidCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-15.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source

@@ -67,6 +67,7 @@ This test reads `$adState.DaclEntries`, filters unresolved `IdentityReference` v
 | MITRE ATT&CK | None |
 | PowerShell test | [Test-MtAdDaclUnresolvedSidDetails](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-16.ps1) |
 | Services | ActiveDirectory |
+| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl |
 | Long running | Yes |
 
 ## Source