Quantcast
Channel: Windows – rakhesh.com
Viewing all articles
Browse latest Browse all 163

Using PowerShell to find Computer objects in AD that have inheritance disabled

$
0
0

I needed to find the computer objects in an AD OU that had inheritance disabled. Did the following:

Get-ADComputer -SearchBase "OU=something,DC=myDomain,DC=com" -Filter * | ?{
  $Computer=$_.DistinguishedName;
  (Get-Acl "AD:\$Computer").AreAccessRulesProtected -eq $True } | ft Name

And to extend this to enable inheritance on the affected objects:

Get-ADComputer -SearchBase "OU=something,DC=myDomain,DC=com" -Filter * | %{
  $Computer=$_.DistinguishedName;
  $ACL=(Get-Acl "AD:\$Computer");
  if ($ACL.AreAccessRulesProtected -eq $True) {
    $ACL.SetAccessRuleProtection($False,$True)
    Set-ACL "AD:\$Computer" -AclObject $ACL
  }
}


Viewing all articles
Browse latest Browse all 163

Trending Articles