Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can list acl from an OU with Get-ACl cmdlet but I need to see the permission entries like we can see in :

OU properties -> Security Tab -> Advanced -> View with Active Directory Users and Computers

Here we are on the Permission entry of the AD Object. What I want is the name of the permission (certainly AD Object properties) and know if it's allow or deny.

The result could be like this :

NT AUTHORITY\SYSTEM | GenericAll | Read Fax Numbers | Allow

NT AUTHORITY\SYSTEM | GenericAll | Write Fax Numbers | Allow


share|improve this question

Get the Quest PowerShell Commands for Active Directory

Get-QADObject "" | Get-QADPermission -inherited| ft account,rights,rightsdisplay,accesscontroltype,source
share|improve this answer
I hope on version 3 of powershell, it will be native to sort this list – user32433 Sep 23 '11 at 9:14

This blog post shows you how to get a report of all OU permissions:

Ashley McGlone, Microsoft PFE,

share|improve this answer
Welcome to Here at superuser we want each answer to be able to stand on its own, meaning that if the links you have provided no longer works, the text in your answer should be enough to use your answer. Please consider editing your post so that it fits this description. – Mogget Apr 15 '13 at 17:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.