Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I can list acl from an OU with Get-ACl cmdlet but I need to see the permission entries like we can see in :

OU properties -> Security Tab -> Advanced -> View with Active Directory Users and Computers

Here we are on the Permission entry of the AD Object. What I want is the name of the permission (certainly AD Object properties) and know if it's allow or deny.

The result could be like this :

NT AUTHORITY\SYSTEM | GenericAll | Read Fax Numbers | Allow

NT AUTHORITY\SYSTEM | GenericAll | Write Fax Numbers | Allow

...

share|improve this question

2 Answers 2

Get the Quest PowerShell Commands for Active Directory

Get-QADObject "your.domain.name/path/to/OU" | Get-QADPermission -inherited| ft account,rights,rightsdisplay,accesscontroltype,source
share|improve this answer
    
I hope on version 3 of powershell, it will be native to sort this list –  user32433 Sep 23 '11 at 9:14

This blog post shows you how to get a report of all OU permissions: http://blogs.technet.com/b/ashleymcglone/archive/2013/03/25/active-directory-ou-permissions-report-free-powershell-script-download.aspx

Ashley McGlone, Microsoft PFE, http://aka.ms/GoateePFE

share|improve this answer
    
Welcome to superuser.com. Here at superuser we want each answer to be able to stand on its own, meaning that if the links you have provided no longer works, the text in your answer should be enough to use your answer. Please consider editing your post so that it fits this description. –  Mogget Apr 15 '13 at 17:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.