I've recently discovered the "adminSDHolder" feature of Active Directory. I need a quick way to identify all users who will be affected by it, namely a script to dump the user accounts.


You can use this powershell script to return the users that have an adminCount greater than 0, which means that they are affected by the adminSDHolder feature. You'll need the AD Module for PowerShell installed, which comes with RSAT.

import-module activedirectory

get-aduser -Filter {admincount -gt 0} -Properties adminCount -ResultSetSize $null      
  • 4
    Here's a cleaner method of doing the same thing: get-aduser -filter {admincount -gt 0} -Properties admincount -ResultSetSize $null – jbsmith Aug 24 '11 at 20:18
  • also you could create a dsquery filter to do the same thing – tony roth Aug 25 '11 at 0:00
  • 2
    @tony - You could, but the OP asked specifically for a PowerShell script. – MDMarra Aug 25 '11 at 2:53

This is a variant on the excellent answer by MDMarra.

Import-Module ActiveDirectory
Get-ADUser -LDAPFilter "(admincount>0)" -Properties adminCount

This uses -LDAPFilter instead of -Filter. Some people prefer to use the LDAP filter syntax because it is portable across many different types of applications.

Note that Filter and LDAPFilter have similar performance characteristics since the filter is executed on the server side. When querying large directories, always try to do filtering directly like this, rather than using Where-Object which would cause all objects to be downloaded before filtering. This is described in detail on the TechNet article Filter vs. Where-Object.

  • I am frequent user of -LDAPFilter so thank you for mentioning it and clarifying it's benefits. – jscott Oct 11 '13 at 1:59
## Script name = Set-IheritablePermissionOnAllUsers.ps1
## sets the "Allow inheritable permissions from parent to propagate to this
##object"check box
# Contains DN of users
#$users = Get-Content C:\C:\Navdeep_DoNotDelete\variables\users.txt

Get-ADgroup -LDAPFilter “(admincount=1)” | select name

$users = Get-ADuser -LDAPFilter “(admincount=1)”

##Get-QADUser -SizeLimit 0 | Select-Object Name,@{n=’IncludeInheritablePermissions’;e={!$_.DirectoryEntry.PSBase.ObjectSecurity.AreAccessRulesProtected}} | Where {!$_.IncludeInheritablePermissions}

ForEach($user in $users)
# Binding the users to DS
$ou = [ADSI]("LDAP://" + $user)
$sec = $ou.psbase.objectSecurity
if ($sec.get_AreAccessRulesProtected())
$isProtected = $false ## allows inheritance
$preserveInheritance = $true ## preserver inhreited rules
$sec.SetAccessRuleProtection($isProtected, $preserveInheritance)
Write-Host "$user is now inherting permissions";
Write-Host "$User Inheritable Permission already set"
  • 1
    This changes permissions which is not what the OP was looking for. Also, changing permissions on these objects won't do a whole lot. Next time the AdminSDHolder process runs, it will reset their permissions. – MDMarra Jun 6 '13 at 11:49
  • 3
    Here be dragons. – Tom O'Connor Jun 6 '13 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.