asked on

Extended Permissions in AD

Does anyone know how to go about searching for users that have the ms-EXCH-EPI-May-Impersonate right in AD?

Justin Durrant

Try http://joeware.net/freetools/tools/adfind/index.htm

FHolden

ASKER

I was thinking more a code solution, I have yet to find anyway using AD Services to find that particular permission.

ASKER CERTIFIED SOLUTION

PFoeckeler

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Chris Dent

> I was thinking more a code solution

Using what language?

I have a PowerShell script that will enumerate extended rights here:

http://www.indented.co.uk/index.php/2009/10/02/get-dsacl/

Chris

FHolden

ASKER

@PFoeckeler: Thanks this was exactly what I was looking for, should be easy to translate to C#
@Chris-Dent: This is a C# project, powershell is very usefull but not the enviornment that I'm dealing with just now.

Chris Dent

Fair enough. If you have trouble translating do come back, I should be able to show you how to enumerate extended rights in C#.

Chris

PFoeckeler

If you want to translate the VBScript into a .NET language, the biggest difference will be the LDAP search, it is rather complicated in vbscript (-> ADO Search with ADSDSOObject), but rather easy with C#, C++, VB whatever... (-> System.DirectoryServices, use the DirectorySearcher here).

Philipp

SOLUTION

Chris Dent

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

FHolden

ASKER

Thanks for the pointer Chris