PowerShell Script to find AD users with adminCount > 0

Question

I've recently discovered the "adminSDHolder" feature of Active Directory. I need a quick way to identify all users who will be affected by it, namely a script to dump the user accounts.

Answer 1

You can use this powershell script to return the users that have an adminCount greater than 0, which means that they are affected by the adminSDHolder feature. You'll need the AD Module for PowerShell installed, which comes with RSAT.

import-module activedirectory

get-aduser -Properties adminCount -Filter * -ResultSetSize $null| foreach-object{
   if ($_.adminCount -gt 0){
   echo $_
   }    
}

Edit:

As jbsmith points out, this should also work too, and is a bit cleaner:

import-module activedirectory

get-aduser -Filter {admincount -gt 0} -Properties adminCount -ResultSetSize $null| foreach-object{      
   echo $_          
}

Answer 2

([adsisearcher]"(AdminCount=1)").findall()

Answer 3

## Script name = Set-IheritablePermissionOnAllUsers.ps1
##
## sets the "Allow inheritable permissions from parent to propagate to this
##object"check box
# Contains DN of users
#
#$users = Get-Content C:\C:\Navdeep_DoNotDelete\variables\users.txt

Get-ADgroup -LDAPFilter “(admincount=1)” | select name

$users = Get-ADuser -LDAPFilter “(admincount=1)”

##Get-QADUser -SizeLimit 0 | Select-Object Name,@{n=’IncludeInheritablePermissions’;e={!$_.DirectoryEntry.PSBase.ObjectSecurity.AreAccessRulesProtected}} | Where {!$_.IncludeInheritablePermissions}

ForEach($user in $users)
{
# Binding the users to DS
$ou = [ADSI]("LDAP://" + $user)
$sec = $ou.psbase.objectSecurity
if ($sec.get_AreAccessRulesProtected())
{
$isProtected = $false ## allows inheritance
$preserveInheritance = $true ## preserver inhreited rules
$sec.SetAccessRuleProtection($isProtected, $preserveInheritance)
$ou.psbase.commitchanges()
Write-Host "$user is now inherting permissions";
}
else
{
Write-Host "$User Inheritable Permission already set"
}
}