How to query for all objects in AD which do NOT have allow inheritable permissions enabled

How can I write an LDAP query for all objects in Active Directory that do NOT have "Allow inheritable permissions from the parent to propagate to this object.." enabled. If not possible in an LDAP query is there some alternate method to produce a report of all these objects other than manually checking each of them?
bccopsNetwork Operations ManagerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Chris DentPowerShell DeveloperCommented:

This works, but does take a long time to run.

Is that what you need? The output format will almost certainly need adjusting, what would you like to see there?


Set objConnection = CreateObject("ADODB.Connection")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objCommand = CreateObject("ADODB.Command")
objCommand.ActiveConnection = objConnection
Set objRootDSE = GetObject("LDAP://RootDSE")
objCommand.CommandText = "SELECT distinguishedName " &_
	"FROM 'LDAP://" & objRootDSE.Get("defaultNamingContext") &_
	"' WHERE objectClass='user'"
Set objRootDSE = Nothing
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Timeout") = 600
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
objCommand.Properties("Cache Results") = False
Set objRecordSet = objCommand.Execute
While Not objRecordSet.EOF
	Set objADObject = GetObject("LDAP://" & objRecordSet.Fields("distinguishedName"))
	Set objSD = objADObject.Get("nTSecurityDescriptor")
	If objSD.Control And SE_DACL_PROTECTED Then
		WScript.Echo objRecordSet.Fields("distinguishedName")
		WScript.Echo "Inheritance Not Enabled"
	End If
Set objRecordSet = Nothing
Set objCommand = Nothing
Set objConnection = Nothing

Open in new window


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
bccopsNetwork Operations ManagerAuthor Commented:
This looks like it's what I need -- will test the script soon and report results.
Chris DentPowerShell DeveloperCommented:

Cool, yell if you need any code changes.

bccopsNetwork Operations ManagerAuthor Commented:
This is precisely what I needed.

Thank you
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.