Active Directory OU Permissions Report: Free PowerShell Script Download

Who owns your OUs?

Have you ever lost your keys? It is a scary feeling. Someone out there could have keys to your house and your car. Your personal safety could be at risk. The same is true in Active Directory.  Do you know who has the keys to all of your accounts?

The Problem

In Active Directory we need to know who has the keys to our organizational units (OUs), the place where our users and computers live. Over the years OUs have grown to meet needs. Different teams may have been delegated access for managing users, groups, and computers. Then you come along as the new administrator. You probably have no idea where permissions have been granted to your OUs. And the scary thing is… neither does anyone else.  I know, because I’ve been there.  I hear the same thing from our customers.

Out-of-the-box we do not have a specific tool to report all of the OU permissions. You have to click each OU and view the security tab one-by-one, and we all know that is entirely impractical.  Today’s post contains a script download to generate a report of this vital information.

OU Permissions

OU permissions are multi-faceted. In other words… it’s complicated. They have a number of properties:

  • Principal
  • Allow/Deny
  • Scope
  • Applies To
  • Permissions

You’ll see the following dialog when you add a permission. This is enough to explain the complexity of the group access notation:


Now look how many Applies to: options there are.  Notice that this box scrolls a long way.


What we need is a report that lists the contents of the Advanced permissions GUI like this for every OU:


The matrix of potential permission configurations is mind-blogging.

The Solution: PowerShell

I had wondered if a report like this could be as simple as:

Import-Module ActiveDirectory
cd AD:
dir –recurse –directory | Get-ACL

Of course what works in our imaginations is rarely as simple in real life.  No, that code would not do it.  However, the concept is the same:

  • Get a list of all OUs
  • Loop through the OUs to retrieve their permissions
  • Export all data to a CSV file

Our good friend Get-ACL reports on more than file system permissions.  We can use this same cmdlet to query OU permissions as well.  Notice that we preface the OU distinguished name with AD:\.  Any time you query permissions with Get-ACL you need to expand the Access property to see the list of permission entries (ACEs):

Get-Acl -Path "AD:\OU=Domain Controllers,DC=wingtiptoys,DC=local" |
  Select-Object -ExpandProperty Access

Here is an example of an ActiveDirectoryAccessRule object that is returned for an OU:


We get an entry like this for every permission assigned to the OU.  My first instinct was to simply dump a list of these to CSV and be done with it.  But then I noticed the ObjectType and InheritedObjectType properties.  Hmmmm.  These are ugly GUIDs… not what we need for the report.  We need to translate these to the names of the objects that receive the permissions.  These names are what we see in that long drop-down list in the screenshot above.

To make a long story short I stayed up until 3AM researching this and traced it all down in the Active Directory Technical Specifications (MS-ADTS) here:

You are welcome to read these pages for yourself to understand the relationships.  Essentially these GUID values are stored on attributes of selected objects in the schema and configuration partitions of the AD database.  You can query these to build a list of names that will make the report readable.  So that’s what I did and put them into a hash table for quick look-ups when we generate the report.

The Big Finish

When we script it all out we get a report that looks something like this:


Obviously there are too many columns to read in the screenshot, but it is quite thorough.  Now you can use filters and pivot tables in Excel to analyze the data and produce reports showing exactly which OUs have delegated permissions, what kind of permissions, and who has them.  Likewise you can pivot the report by group to see a list of all OUs that a group can control.  You may want to filter the output by the IsInherited property.  By filtering for FALSE you will find everywhere that permissions are explicitly delegated in the OU tree.


I would advise all Active Directory shops to run and review this report on a quarterly basis to make sure there are no surprise administrators lurking in your domain. The report can be quite large for any size organization.  Perhaps this would be a good report to feed to the Information Security team, if you have one.  Now you know who holds the keys.


Download the full script from the TechNet Script Gallery.

Comments (43)

  1. Patris_70 says:

    Please check script. OU_permissions.p-s-1.txt is empty!


  2. Patris_70 says:

    You are Great guy

    Can use this PS script for other AD objects permission, such as user or group?

    Thank you so much

  3. Hello John,

    This one-liner will list all of your OUs and their owners:

    Get-ADOrganizationalUnit -filter * -Properties nTSecurityDescriptor | Select-Object DistinguishedName, @{name=’Owner’;Expression={$_.nTSecurityDescriptor.Owner}}

    Hope this helps,

  4. Hello Patris_70,

    I'm not sure what happened to the script file.  I have fixed it now by linking to the copy posted at the TechNet Script Gallery.

    As for permissions on other object types they should work the same way.  You can modify the script accordingly.

    Thanks for the feedback,


  5. Ed (DareDevil57) says:

    thank you

  6. @LMS,
    I have updated the script download to now include the root of the domain in the permissions report. I don’t know why I didn’t do that to begin with. Thanks for the feedback.
    Ashley McGlone

  7. Hi Neil,

    Great question!  To scale this script across forests, domains, and trusts I can think of two methods:

    1.  You could parameterize the script in a function.  The parameters could reference the target server name and a credentials object that you capture.  Then you could modify all of the calls in the script to use these parameters.  This would be thorough, but a bit more time-consuming.

    2.  The easiest way would be to use Invoke-Command against the remote server and pass credentials like this:

    Invoke-Command -ComputerName -Credential (Get-Credential) -FilePath .OU_permissions.ps1 |

    Export-CSV .Remote-OUs.csv -NoTypeInformation

    In order for this last part to work I took out the final part of the script which exports the CSV.  This way it dumps $report into your local session for exporting locally.

    Hope this helps,


  8. Ken Brumfield's CheckDSAcls.exe on Codeplex also does this, which had been the only way I knew to produce this type of "who has permissions on my OU" report (using /SearchForAcct switch). It is nice to see PowerShell can be leveraged to produce similar reports. Your investigation of the GUIDs in MS-ADTS is particularly helpful. Thanks for this script.

  9. Anonymous says:

    Thanks for this script. It is extremely useful!

    Smita C

  10. Ed (DareDevil57) says:


  11. Patris_70 says:

    Hello Ashely,

    Thank you for your immediate answer and support.

    Best regards

  12. Ed (DareDevil57) says:

    thanks for sharing.

  13. Hi Krishna,

    Great question. Here are a couple options for the current user:

    whoami /priv
    GPRESULT or Get-GPResultantSetOfPolicy

    For default group privileges:

    For tracking down user and group privileges in the directory:

    Hope this helps,

  14. Hi Emily,
    Can you find the file OU_Permissions.csv in your working directory?

  15. Neil says:


    How would you go about running this against another domain in the forest or a domain you have a trust with?

  16. Guillaume A. says:


    Doyou know this tool created by one of your colleague?…/permissions-in-ad-lost-control.aspx



  17. Dwight M says:

    Guy, this is a great script. How can I export each OU to separate .CSV files? I would like each file to be named OU=Service Accounts,OU=Corp Objects,DC=corp,DC=domain,DC=com. Each file will be named with it's own distinctive OU. How can I go about accomplishing this?


  18. Hello Dwight,

    This should put each OU in its own file:

    $schemaIDGUID = @{}

    $ErrorActionPreference = 'SilentlyContinue'

    Get-ADObject -SearchBase (Get-ADRootDSE).schemaNamingContext -LDAPFilter '(schemaIDGUID=*)' -Properties name, schemaIDGUID |

    ForEach-Object {$schemaIDGUID.add([System.GUID]$_.schemaIDGUID,$}

    Get-ADObject -SearchBase "CN=Extended-Rights,$((Get-ADRootDSE).configurationNamingContext)" -LDAPFilter '(objectClass=controlAccessRight)' -Properties name, rightsGUID |

    ForEach-Object {$schemaIDGUID.add([System.GUID]$_.rightsGUID,$}

    $ErrorActionPreference = 'Continue'

    # Get a list of all OUs.  Add in the root containers for good measure (users, computers, etc.).

    $OUs  = Get-ADOrganizationalUnit -Filter * | Select-Object -ExpandProperty DistinguishedName

    $OUs += Get-ADObject -SearchBase (Get-ADDomain).DistinguishedName -SearchScope OneLevel -LDAPFilter '(objectClass=container)' | Select-Object -ExpandProperty DistinguishedName

    # Loop through each of the OUs and retrieve their permissions.

    # Add report columns to contain the OU path and string names of the ObjectTypes.

    ForEach ($OU in $OUs) {

       # This array will hold the report output.

       $report = @()

       $report += Get-Acl -Path "AD:$OU" |

        Select-Object -ExpandProperty Access |

        Select-Object @{name='organizationalUnit';expression={$OU}}, `

                      @{name='objectTypeName';expression={if ($_.objectType.ToString() -eq '00000000-0000-0000-0000-000000000000') {'All'} Else {$schemaIDGUID.Item($_.objectType)}}}, `

                      @{name='inheritedObjectTypeName';expression={$schemaIDGUID.Item($_.inheritedObjectType)}}, `


       # Dump the raw report out to a CSV file for analysis in Excel.

       $report | Export-Csv ".$OU.csv" -NoTypeInformation


  19. Chris says:

    If anyone wants an easy to use GUI alternative to the Powershell options, I made a tool recently for reporting AD permissions. More info and a download link for the free edition (which is not time limited) here for anyone interested:

  20. Anonymous says:

    Today's post gives you a script to crawl your file shares and document the AD users and groups referenced in NTFS permissions. I’m sure others have published similar scripts, but I want to approach it from the angle of Active Directory group

  21. ajay says:

    Gr8 Gui Tool Chris

  22. Anon says:

    Great script, thanks very much!

  23. John Ball says:

    How can I get the owner on AD OU’s?

  24. LMS says:

    Great Script, it will be helpful to know how to get permissions from Domain root also

  25. Neb says:

    Hmm simply use Get-ADPermission from Exchange admin tools ? Never understood why such a critical cmdlet belonged exclusively to the Exchange group, when AD admins have so much use of it, and must struggle with Get-ACL instead…

  26. LMS says:

    We tried as below

    Get-ADPermission -Identity | ft user, Identity, deny, Accessrights, IsInherited, Properties, ChildobjectTypes, InheritedObjecttype, Inheritancetype -wrap > rrr.txt

    Also exported to csv with notypeinfo. But the output not contains all the fields or it’s getting to the next line. Even we tried to mention the width as following ($fileds = @{Expression={$_.user};Label="User";width=25}, etc ), but still failed to achieve a
    perfect report.

    Expect your support


  27. LMS says:

    The script to check permissions at domain root is as below

    Get-ADPermission -Identity | select-object user, Identity, deny, @{n="AccessRights";e={($_ | select -expandproperty AccessRights) -join ‘|’ }},@{n="ExtendedRights";e={($_ | select -expandproperty ExtendedRights) -join ‘|’ }}, IsInherited, @{label
    = "Properties ";expression = {[string]$_.Properties }}, @{label = "ChildobjectTypes";expression = {[string]$_.ChildobjectTypes }}, InheritedObjecttype, Inheritancetype | export-csv C:get-adpermission.csv


  28. LMS says:

    It’s Great, Thank You…

  29. Anonymous says:

    Welcome! Today’s post includes demo scripts and links from the Microsoft Virtual Academy event: Using PowerShell for Active Directory . We had a great time creating this for you, and I hope you will share it with anyone needing to ramp up their

  30. Krishna says:

    how do I know the privileges of a particular user/Group?

  31. charles says:

    Great script, extremely helpful! Thank you very much for sharing

  32. Emily says:

    This script does nothing it appears to run for me but I never see any output

  33. Mohammed says:

    Thank you Ashley! your videos on AD powershell are great. And yes you are powershellAD_master

  34. terry says:

    What if I don’t want to search the entire domain, but instead, want to search through the entire OU structure of a single OU in a domain? Also, what about do this in different domains (run script on domain B from domain A)?

  35. Gareth Thomas says:

    Do the new LAPS attributes have their own unique GUID? I er, binged the schemaIDGUID value in my schema for one of the new properties with no result, so is it randomly created?

  36. Nazir says:

    How can find if a user ABC has delegation for any OU or not.

  37. Paul Bendall says:


    Another great script and I like the tight method for creating the hash-table for the GUIDID from the schema. I’m using this to check or apply the necessary delegation of privileges for Azure AD Connect service account so it can only write-back to attributes we want (least privilege) but I can also monitor after setting using your approach. Thanks for sharing


  38. Avi says:

    Hi, can you help me with extracting report with the help of Powershell for entire domain? Like how many active AD groups their description and all..



  39. Anup Singh says:

    Is there any PS command to find out who is moving users from one OU to another in windows 2008 R2 domain.

  40. BradBird says:

    How do I run this? Do I run it as is with a parameter? Or do I take pieces of it?

  41. Gasper says:

    Great script! Ty

  42. Matthias Thiel says:

    Hello Ashley,

    thank you for your great article. I got here while looking for a way to get a list of all possible inheritance-options (see your “Applies to”-screenshot). As far as I know this uses the “ActiveDirectoryAccessRule.InheritanceType” .Net-class with the “appliesto”-property but unfortunately I can’t find any way to get a list or an export of this above mentioned dropdown-list. Do you have, by any chance, an idea how to realise this via powershell ?

    Thanks in advance and kind regards


  43. steve tretakis says:

    Great and many , many thanks but.. i give up… how do i target for child domains? Thanks for this, this is a huge help for a serious issue i have been trying to get a handle on for yrs