Summary

Tenable is pleased to announce the release of three new atomic compliance check types for Windows auditing: FILE_DACL, REGISTRY_DACL, and SERVICE_DACL. These check types give audit authors a cleaner, more expressive way to assess discretionary access control list (DACL) permissions on files, registry keys, and services.

Change

These check types improve upon FILE_ACL, REGISTRY_ACL, and SERVICE_ACL check types. The rename to DACL reflects the correct Windows security terminology and aligns with how permission auditing is actually described in benchmarks and hardening guidance. The Audits & Compliance team will be using these check types for all published audits going forward and will be updating existing content to use them.

Impact

Easier check writing - Each permission check is a single, self-contained atomic check. There is no need to pair a check with a companion ACL structure. The access control criteria are expressed directly in the check itself, reducing the surface area for authoring errors.

Easier tailoring - Because all relevant information lives within the atomic check block, policy customization is straightforward. Reviewers, implementers, and content consumers can read exactly what a check requires without cross-referencing a separate structure in the .audit file.

Documentation - Usage and examples are available in the Nessus Compliance Checks Reference:

FILE_DACL

https://docs.tenable.com/nessus/compliance-checks-reference/Content/FILE_DACL.htm

REGISTRY_DACL

https://docs.tenable.com/nessus/compliance-checks-reference/Content/REGISTRY_DACL.htm

SERVICE_DACL

https://docs.tenable.com/nessus/compliance-checks-reference/Content/SERVICE_DACL.htm

Target Release Date

August 27, 2026