• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 997
  • Last Modified:

Re-instate AD OU Inheritance?


In my organization we have more than 1000 OU's in place. Most of the OU's dont have inheritance enabled.
I have the exact same issue as the poster here:

Could anyone tell me how that person managed to do this?

I have tried to figure out joeware and admod but i cant seem to find a way to do this.

  • 4
  • 3
1 Solution
Chris DentPowerShell DeveloperCommented:
The quoted command is missing a space, that won't help:

adfind -default -f objectcategory=organizationalunit -sc aclnoinherit

Otherwise are you getting an error message? Or just 0 Objects returned?

Hal-itosisAuthor Commented:
Sorry, maybe I was not clear in explaining.

The command listed works fine (I knew about the space) but that just lists the OU's that need tp have inheritance re-instated.

What command do I use to do this for any OU in the domain that does not have policy inheritance selected?
Chris DentPowerShell DeveloperCommented:

Just to be clear, are you talking about Group Policy Inheritance? Or ACL inheritance? The two are not the same and how we might deal with each is quite different.

And which version of Windows do we have available to make changes on? That'll impact the tools we can use.

Never miss a deadline with monday.com

The revolutionary project management tool is here!   Plan visually with a single glance and make sure your projects get done.

Hal-itosisAuthor Commented:
Yes, its ACL and not GPO and the Directory is Server 2003 Native. Mix of 2008 R2 and 2003 DC's
Chris DentPowerShell DeveloperCommented:
Great, I wanted to make sure.

Personally I'd go for PowerShell to set this back, we're going to have to use some kind of scripting language and it's far less messy than VbScript.

You don't need it installed on the server, although it will be under 2008 R2, I'd run it from your workstation. If you run XP and don't already have it, you can download it here:


We may as well stick with adfind for the hard bit, then we'll take what we get from that and have PS change things for us. It's quite easy, honest.
./adfind.exe -default -f objectcategory=organizationalunit -sc aclnoinherit |
  Where-Object { $_ -Match '^dn:' } |
  ForEach-Object {
    $OU = [ADSI]"LDAP://$($_ -Replace '^dn:')"

    Write-Host "Resetting inheritance on $($OU.Get('distinguishedname'))"

    # $OU.PsBase.ObjectSecurity.SetAccessRuleProtection($False, $False)
    # $OU.CommitChanges()

Open in new window

Copy and paste the snippet above into PowerShell, I'm assuming you have ADFind in the same directory.

This lets us test, it won't make any changes, only tell us about them. If you're happy it's targeting the right stuff remove the "#" character from the two lines starts $OU. That'll commit the change and enable inheritance for all OUs found by Joe's tool.


Hal-itosisAuthor Commented:
That’s a thing of beauty right there Chris,

Worked like a champ!

Thanks so much and sorry for posting on so many forums :-)
I was getting desperate.

First time using PowerShell actually, must start using it a bit more/learn it.
Mike KlineCommented:
Don't forget to thank Chris over on Activedir too.....may help if Chris is ever nominated for an MVP award :)
Hal-itosisAuthor Commented:

Thanks again, you saved me hours of clicks :-)
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now