Active directory objects to inherit its permissions form its parent. How to do an update to an entire ou.

Posted on 2009-04-22
Last Modified: 2012-05-06

I have an Active Directory (2003 based) ou with more than 8000 opjects in it and some of the opjects are not set in their security section to inherit their permissions from the parent ou.

I do not want to change or remove extra permissions, but I would like to set the all the objects to inherit its permissions from the parent.

I think this should be done with a VB script. Can someone help will creating that script or powershell command that will return a list of users that are not set to inherit its permissions from the parent.

Thanks Peter
Question by:PeterSinger
    LVL 30

    Accepted Solution

    A caveat - if any of the users in question are, or have ever been, members of a protected group such as Domain Admins, Administrators, Account Operators or Server Operators, any change you make to the inheritance settings on the account will be automatically rolled back by AD within 1 hour. This behavior is by design, and explained here:

    If this is not the case, you can list and re-enable permissions inheritance using a combination of VBScript and dsacls; sample syntax can be found here:
    LVL 49

    Assisted Solution

    here is something for you right from

    Param($DN = ([ADSI]"").distinguishedName)
    Write-Host "Using: $DN"
    $ds = new-Object System.DirectoryServices.DirectorySearcher([ADSI]"LDAP://$dn","(objectcategory=user)")
    $users = $ds.FindAll()
    foreach($usr in $users)
        $user = $usr.GetDirectoryEntry()
        Write-Host "Processing User: $($user.sAMAccountName)"

    Open in new window


    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    Installing a printer using group policy preferences is not that hard let’s take a look at it. First lets open up your group policy console and edit the policy you want to add it to. I recommend creating a new policy for each printer makes it a l…
    This article is the result of a quest to better understand Task Scheduler 2.0 and all the newer objects available in vbscript in this version over  the limited options we had scripting in Task Scheduler 1.0.  As I started my journey of knowledge I f…
    This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now