Search code examples
powershellactive-directory

How to enumerate AD organizational units where inheritance is disabled

How can I enumerate Active Directory organizational units where permissions inheritance has been disabled, programmatically using PowerShell.

Solution

  • Hi you could manually code it and query the SE_DACL_PROTECTED attribute using the Invoke-FindOUpermissions.ps1 script as a baseline https://gist.github.com/neKuehn/61f70b2d54a4344b5638c0625e2f8ca6

    or try the following

    How to get an Active Directory OU permissions report - https://community.spiceworks.com/how_to/149278-how-to-get-an-active-directory-ou-permissions-report

    Active Directory Security, Permission and ACL Analysis http://www.ldapexplorer.com/en/liza.htm