Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am new to Server Fault and was hoping to find an answer to a question that I have been struggling with for the past week or so. I have been recently asked by my management to furnish a list of all the effective rights / permissions delegated on the Active Directory object for our Domain Admins group.

I initially figured I'd use the Effective Permissions Tab in Active Directory Users and Computers but had two problems with it. The first was that it doesn't seem very accurate and the second was that it requires me to enter the name of a specific user, and it only shows me what it figures are effective permissions for that user. Now, we have more than a 1000 users in our environment so there's no way I can possibly enter 1000 user names one by one. Plus, there is no way to export that information either.

I also looked at dsacls from MS but it doesn't do effective permissions. Someone pointed me to a tool called ADUCAdmin but that seems to falsely claim to do effective permissions.

Could someone kindly help me find a way to obtain this listing? Basically, I need to generate a list of all the modify effective permissions granted on the Domain Admins group object along with the list of all the admins to which these permissions are granted. In case it helps, I don't need a fancy listing - simple text / CSV output would be enough

I would be grateful for any assistance since this is time and security sensitive for us.

share|improve this question
This is has been an issue forever. Typically this issue arises when someone has access to a resource and it is not obvious how or why they do have it. There is even a very expensive application which claims to be the "world's first and only solution that can determine true Active Directory effective permissions". I'm not going to specify which one, but you can google that phrase and try their demo to see if it does indeed work. –  Greg Askew Dec 12 '12 at 11:33

1 Answer 1

The closest I have been able to find is Acldiag (syntax here) from the Windows Server 2003 Support Tools (download here).

The syntax sucks and I can't figure out how to specify a specific user/group, but the following gets close to what you are after. Hopefully you will have better luck with the syntax, good luck.

acldiag "OU=OrganizationalUnit,DC=domain" /geteffective:* /skip /tdo

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.