Search code examples
powershellwindows-server-2008user-accountsuser-permissions

user account "effective permissions" with powershell

I need to compare AD users permissions (one user can "unset" an attribute and another cannot, both can change it).

How can I dump/compare user account "effective permissions" which I find when I go to user account > Security > Advanced > Effective Permissions (and select an user account) with powershell?

Solution

  • Using Quest Free PowerShell Commands for Active Directory is simple:

    Get-QadPermission useraccountname -Inherited

    or better way:

    Get-QADUser -Name useraccountname -SecurityMask DACL | Get-QADPermission -Inherited -SchemaDefault

    This return all effective permission Inherited or Explicit assigned for the user 'useraccountname'

    The comparison can be made with compare-object. A very simple example:

    compare-object (Get-QADPermission userA -Inherited | select Rights) (Get-QADPermission userB -Inherited | select rights)