Akamai's read-only PowerShell scanner enumerates Active Directory OUs and reports nondefault identities with allowed ACEs or OU ownership that may permit dMSA creation or related OU permission changes. It requires domain read access and reads each OU's ntSecurityDescriptor. It excludes Domain Admins, built-in Administrators, SYSTEM, and Enterprise Admins. It ignores DENY ACEs, does not expand group membership or calculate effective permissions, and uses a non-exhaustive rights list, so findings are candidates that require validation. It scans OU descriptors only; it does not inventory permissions on existing dMSA objects or establish exploitability under the current CVE-2025-53779 patch state.
PowerShell
RESTRICTED_ACCESS_BLUR_MARKER