get-acl for AD securtiy group permissions
what would the correct get-acl syntax be for getting the ACL on who can manage an AD security group. I've only used get-acl for folder permissions, e.g. get-acl \\server\share - But I have read you can use it for checking permissions on AD objects to, so knowing the correct format for that would be useful to check for delegations etc.
Do more with
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Basically the same way it works with NTFS: you pass the path to the target, and check the Access property.
The path in this case is the drive "AD:" and the object's DistinguishedName.
For starters, you can send the output to Out-GridView, for example:
The permissions differ from NTFS, obviously. Start here, for example:
How Access Control Works in Active Directory Domain Services
https://docs.microsoft.com/en-us/windows/desktop/ad/how-access-control-works-in-active-directory-domain-services
Active Directory Object Permissions 101
https://redmondmag.com/articles/2001/10/01/active-directory-object-permissions-101.aspx
The path in this case is the drive "AD:" and the object's DistinguishedName.
For starters, you can send the output to Out-GridView, for example:
Get-Acl -Path 'AD:\CN=Some Group,OU=Some OU,DC=domain,DC=com' | Select-Object -ExpandProperty Access | Out-GridView
Get-Acl -Path 'AD:\CN=Some Group,OU=Some OU,DC=domain,DC=com' | Select-Object -ExpandProperty Access |
Where-Object {$_.IdentityReference.ToString() -like "$ENV:UserDomain\*"}
The permissions differ from NTFS, obviously. Start here, for example:
How Access Control Works in Active Directory Domain Services
https://docs.microsoft.com/en-us/windows/desktop/ad/how-access-control-works-in-active-directory-domain-services
Active Directory Object Permissions 101
https://redmondmag.com/articles/2001/10/01/active-directory-object-permissions-101.aspx
Premium Content
You need an Expert Office subscription to comment.Start Free Trial