# Active Directory User Properties Security Information

**URL:** <https://forums.powershell.org/t/active-directory-user-properties-security-information/13251>\
**Category:** PowerShell Help\
**Created:** [October 8, 2019, 8:15am UTC](https://forums.powershell.org/t/active-directory-user-properties-security-information/13251 "2019-10-08T08:15:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![computernations](https://avatars.discourse-cdn.com/v4/letter/c/a8b319/32.png) [@computernations](https://forums.powershell.org/u/computernations)\
**Post date:** [October 8, 2019, 8:15am UTC](https://forums.powershell.org/t/active-directory-user-properties-security-information/13251/1 "2019-10-08T08:15:07Z")

</div>

You know when you open a user’s properties in Active Directory and there is a security tab. It is my understanding that this is a user’s ACL and it shows security groups that have been applied to a user via methods such as manual assignment, delegation, and GPOs for example. I am looking for a way to check to see if there is a security group applied to all my users. So I’m looking for a PS command that will output all users with a specific ACL applied to them and all users that are missing a specific ACL. I think I could get all my users and their ACLs and then filter this list for a specific applied security group (present or not present). Thanks for your time and assistance.

---

<div class="post-metadata">

**Author:** ![masterofthehat](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/masterofthehat/32/5116_2.png) [@masterofthehat](https://forums.powershell.org/u/masterofthehat)\
**Post date:** [October 8, 2019, 10:42am UTC](https://forums.powershell.org/t/active-directory-user-properties-security-information/13251/2 "2019-10-08T10:42:23Z")

</div>

This should get you started. You’ll need to get a list of all users and then run this against each of them to figure out who has the ACL you’re looking for.

```
PS E:\> (get-acl -path "AD:CN=User1,OU=People,DC=MyDomain,DC=com").access | Where IdentityReference -eq "MyDomain\domain admins"

ActiveDirectoryRights : CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl,
                        WriteOwner
InheritanceType : None
ObjectType : 00000000-0000-0000-0000-000000000000
InheritedObjectType : 00000000-0000-0000-0000-000000000000
ObjectFlags : None
AccessControlType : Allow
IdentityReference : MyDomain\Domain Admins
IsInherited : False
InheritanceFlags : None
PropagationFlags : None
```

---

<div class="post-metadata">

**Author:** ![computernations](https://avatars.discourse-cdn.com/v4/letter/c/a8b319/32.png) [@computernations](https://forums.powershell.org/u/computernations)\
**Post date:** [October 8, 2019, 2:42pm UTC](https://forums.powershell.org/t/active-directory-user-properties-security-information/13251/3 "2019-10-08T14:42:07Z")

</div>

Thank you Charles for this code. Can you tell me how to get a list of users WITH their acl properties?

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:31pm UTC](https://forums.powershell.org/t/active-directory-user-properties-security-information/13251/4 "2024-05-16T20:31:18Z")

</div>