ACL AD OU

Экспортировать действующие ACL объектов в AD:

$schemaIDGUID = @{}

$ErrorActionPreference = 'SilentlyContinue'

Get-ADObject -SearchBase (Get-ADRootDSE).schemaNamingContext -LDAPFilter '(schemaIDGUID=*)' -Properties name, schemaIDGUID |

 ForEach-Object {$schemaIDGUID.add([System.GUID]$_.schemaIDGUID,$_.name)}

Get-ADObject -SearchBase "CN=Extended-Rights,$((Get-ADRootDSE).configurationNamingContext)" -LDAPFilter '(objectClass=controlAccessRight)' -Properties name, rightsGUID |

 ForEach-Object {$schemaIDGUID.add([System.GUID]$_.rightsGUID,$_.name)}

$ErrorActionPreference = 'Continue'

$OUs  = Get-ADOrganizationalUnit -Filter * | Select-Object -ExpandProperty DistinguishedName

$OUs += Get-ADObject -SearchBase (Get-ADDomain).DistinguishedName -SearchScope OneLevel -LDAPFilter '(objectClass=container)' | Select-Object -ExpandProperty DistinguishedName

#$OU = "OU=Tcs-users,DC=tcsbank,DC=ru"

ForEach ($OU in $OUs) {

    $report += Get-Acl -Path "AD:\$OU" |

     Select-Object -ExpandProperty Access | 

     Select-Object @{name='organizationalUnit';expression={$OU}}, `

                   @{name='objectTypeName';expression={if ($_.objectType.ToString() -eq '00000000-0000-0000-0000-000000000000') {'All'} Else {$schemaIDGUID.Item($_.objectType)}}}, `

                   @{name='inheritedObjectTypeName';expression={$schemaIDGUID.Item($_.inheritedObjectType)}}, `

                   *

}

# Dump the raw report out to a CSV file for analysis in Excel.

$report | Export-Csv ".\OU_Permissions.csv" -NoTypeInformation -delimiter "`t" -encoding default

Start-Process ".\OU_Permissions.csv"