Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've recently discovered the "adminSDHolder" feature of Active Directory. I need a quick way to identify all users who will be affected by it, namely a script to dump the user accounts.

share|improve this question
up vote 18 down vote accepted

You can use this powershell script to return the users that have an adminCount greater than 0, which means that they are affected by the adminSDHolder feature. You'll need the AD Module for PowerShell installed, which comes with RSAT.

import-module activedirectory

get-aduser -Filter {admincount -gt 0} -Properties adminCount -ResultSetSize $null      
share|improve this answer
Here's a cleaner method of doing the same thing: get-aduser -filter {admincount -gt 0} -Properties admincount -ResultSetSize $null – jbsmith Aug 24 '11 at 20:18
also you could create a dsquery filter to do the same thing – tony roth Aug 25 '11 at 0:00
@tony - You could, but the OP asked specifically for a PowerShell script. – MDMarra Aug 25 '11 at 2:53
share|improve this answer

This is a variant on the excellent answer by MDMarra.

Import-Module ActiveDirectory
Get-ADUser -LDAPFilter "(admincount>0)" -Properties adminCount

This uses -LDAPFilter instead of -Filter. Some people prefer to use the LDAP filter syntax because it is portable across many different types of applications.

Note that Filter and LDAPFilter have similar performance characteristics since the filter is executed on the server side. When querying large directories, always try to do filtering directly like this, rather than using Where-Object which would cause all objects to be downloaded before filtering. This is described in detail on the TechNet article Filter vs. Where-Object.

share|improve this answer
I am frequent user of -LDAPFilter so thank you for mentioning it and clarifying it's benefits. – jscott Oct 11 '13 at 1:59
## Script name = Set-IheritablePermissionOnAllUsers.ps1
## sets the "Allow inheritable permissions from parent to propagate to this
##object"check box
# Contains DN of users
#$users = Get-Content C:\C:\Navdeep_DoNotDelete\variables\users.txt

Get-ADgroup -LDAPFilter “(admincount=1)” | select name

$users = Get-ADuser -LDAPFilter “(admincount=1)”

##Get-QADUser -SizeLimit 0 | Select-Object Name,@{n=’IncludeInheritablePermissions’;e={!$_.DirectoryEntry.PSBase.ObjectSecurity.AreAccessRulesProtected}} | Where {!$_.IncludeInheritablePermissions}

ForEach($user in $users)
# Binding the users to DS
$ou = [ADSI]("LDAP://" + $user)
$sec = $ou.psbase.objectSecurity
if ($sec.get_AreAccessRulesProtected())
$isProtected = $false ## allows inheritance
$preserveInheritance = $true ## preserver inhreited rules
$sec.SetAccessRuleProtection($isProtected, $preserveInheritance)
Write-Host "$user is now inherting permissions";
Write-Host "$User Inheritable Permission already set"
share|improve this answer
This changes permissions which is not what the OP was looking for. Also, changing permissions on these objects won't do a whole lot. Next time the AdminSDHolder process runs, it will reset their permissions. – MDMarra Jun 6 '13 at 11:49
Here be dragons. – Tom O'Connor Jun 6 '13 at 12:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.