You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/en-US/Get-ADEffectiveAccess.md
+46-38Lines changed: 46 additions & 38 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ schema: 2.0.0
9
9
10
10
## SYNOPSIS
11
11
12
-
{{ Fill in the Synopsis }}
12
+
Retrieves effective access and audit rules for Active Directory objects, translating `ObjectType` and `InheritedObjectType` GUIDs into human-readable names.
13
13
14
14
## SYNTAX
15
15
@@ -45,7 +45,9 @@ Get-ADEffectiveAccess
45
45
46
46
## DESCRIPTION
47
47
48
-
{{ Fill in the Description }}
48
+
An enhanced alternative to `Get-Acl` for Active Directory, this cmdlet retrieves access control lists (ACLs) for AD objects, returning effective access and audit rules. It translates `ObjectType` and `InheritedObjectType` GUIDs into human-readable names using a per-session, per-domain map for improved performance and readability.
49
+
50
+
Unlike `Get-Acl`, there is no dependency on the Active Directory module and includes built-in LDAP search functionality to locate objects.
49
51
50
52
## EXAMPLES
51
53
@@ -61,7 +63,11 @@ PS C:\> {{ Add example code here }}
61
63
62
64
### -Audit
63
65
64
-
Use this switch to include audit rules for the security descriptor from the system access control list (SACL).
66
+
Use this switch to include audit rules from the System Access Control List (SACL).
67
+
68
+
> [!NOTE]
69
+
>
70
+
> Usage of this switch may impact performance in large directories.
Specifies a user account that has permission to perform this action. The default is the current user.
81
-
82
-
Type a user name, such as `User01` or `myDomain\User01`, or enter a [`PSCredential`](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.pscredential) object generated by the [`Get-Credential` cmdlet](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-credential). If you type a user name, you're prompted to enter the password.
86
+
Specifies a user account with permission to perform this action. Default is the current user. Accepts a username (e.g., `User01`, `myDomain\User01`) or a [`PSCredential`](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.pscredential) object from [`Get-Credential`](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-credential). Prompts for a password if a username is provided.
Use this switch to include deleted objects in your search. This switch is also required when getting the ACL for a deleted Identity.
99
-
100
-
For more details, see [`DirectorySearcher.Tombstone` Property](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.directorysearcher.tombstone#system-directoryservices-directorysearcher-tombstone).
102
+
Includes deleted objects in the search. Required when retrieving ACLs for deleted objects. See [`DirectorySearcher.Tombstone`](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.directorysearcher.tombstone#system-directoryservices-directorysearcher-tombstone) for details.
Specifies an LDAP query string that is used to filter Active Directory objects you want to get the ACL from.
118
+
Specifies an LDAP query to filter Active Directory objects (e.g., `(objectClass=user)`).
117
119
118
120
For more details, see the [__Remarks__ section from `DirectorySearcher.Filter`](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.directorysearcher.filter#remarks).
The maximum number of objects you want to get the ACL from. The default value is `0`, meaning that the maximum number of object you will be getting the ACL from is determined by your LDAP filter or lack of it (all objects).
188
-
189
-
See also [`DirectorySearcher.SizeLimit` Property](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.directorysearcher.sizelimit#system-directoryservices-directorysearcher-sizelimit).
180
+
Limits the number of objects to retrieve ACLs for. Default is `0` (no limit, determined by LDAP filter). See [`DirectorySearcher.SizeLimit`](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.directorysearcher.sizelimit#system-directoryservices-directorysearcher-sizelimit) for details.
Specifies the authentication method to use. The default value is `Secure`.
196
+
Specifies the authentication method. Default is `Secure`.
206
197
207
-
> [!NOTE]
198
+
> [!TIP]
208
199
>
209
-
> [`AuthenticationTypes`](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.authenticationtypes) is a Flags Enum, meaning that you can combine values, for example `-AuthenticationTypes 'Secure, FastBind'` is valid.
200
+
> [`AuthenticationTypes`](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.authenticationtypes) is a `Flags` Enum, you can combine values as needed, e.g.: `-AuthenticationTypes 'Secure, FastBind'`.
Specifies an Active Directory object by providing one of the following property values. The identifier in parentheses is the LDAP display name for the attribute.
216
+
Specifies an Active Directory object by:
226
217
227
218
- A DistinguishedName
228
219
- A GUID (`objectGuid`)
@@ -231,7 +222,7 @@ Specifies an Active Directory object by providing one of the following property
231
222
232
223
> [!TIP]
233
224
>
234
-
> This parameter takes pipeline input. You can pipe the output from [ActiveDirectory cmdlets](https://learn.microsoft.com/en-us/powershell/module/activedirectory) to this parameter whenever the output has an `objectGuid` or a `DistinguishedName` property.
225
+
> Accepts pipeline inputfrom [ActiveDirectory cmdlets](https://learn.microsoft.com/en-us/powershell/module/activedirectory) with `objectGuid` or `DistinguishedName` properties.
Determines the maximum number of objects the server can return in a paged search. The default is `1000`.
241
+
Sets the maximum number of objects returned per page in a paged search. Default is `1000`.
251
242
252
-
See also [`DirectorySearcher.PageSize` Property](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.directorysearcher.pagesize) for more details.
243
+
See [`DirectorySearcher.PageSize`](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.directorysearcher.pagesize) for more details.
Specifies the `DistinguishedName` of an Organization Unit or Container as the base for your search.
259
+
Specifies the `DistinguishedName` of an Organizational Unit or Container as the search base. Defaults to the domain root if not specified.
269
260
270
261
```yaml
271
262
Type: String
@@ -287,12 +278,29 @@ This cmdlet supports the common parameters. For more information, see [about_Com
287
278
288
279
### System.String
289
280
281
+
Accepts a string representing a `DistinguishedName`, `objectGuid`, `objectSid`, or `sAMAccountName` via pipeline for the [`-Identity` parameter](#-identity). You can also pipe objects from Active Directory cmdlets having `DistinguishedName` or `objectGuid` properties.
282
+
290
283
## OUTPUTS
291
284
292
285
### ADEffectiveAccess.EffectiveAccessRule
293
286
287
+
Represents effective access rules with resolved `ObjectType` and `InheritedObjectType` GUIDs.
288
+
294
289
### ADEffectiveAccess.EffectiveAuditRule
295
290
291
+
Represents effective audit rules with resolved `ObjectType` and `InheritedObjectType` GUIDs (when `-Audit` is specified).
292
+
296
293
## NOTES
297
294
295
+
- This cmdlet maintains a per-session, per-domain map to translate `ObjectType` and `InheritedObjectType` into human-readable names, improving usability and performance.
296
+
- Querying audit rules (`-Audit`) or deleted objects (`-IncludeDeletedObjects`) may impact performance on large directories.
297
+
- Ensure the account used has sufficient permissions to read security descriptors.
0 commit comments