# Determine ACLs on AD object

**URL:** <https://forums.powershell.org/t/determine-acls-on-ad-object/9297>\
**Category:** PowerShell Help\
**Created:** [September 5, 2017, 3:38pm UTC](https://forums.powershell.org/t/determine-acls-on-ad-object/9297 "2017-09-05T15:38:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeff-taylor](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/jeff-taylor/32/1015_2.png) [@jeff-taylor](https://forums.powershell.org/u/jeff-taylor)\
**Post date:** [September 5, 2017, 3:38pm UTC](https://forums.powershell.org/t/determine-acls-on-ad-object/9297/1 "2017-09-05T15:38:47Z")

</div>

I’d like to determine what kind of permissions a specific user (service account) has on a particular AD user object. I have this one liner:

```
(Get-ACL ‘AD:\CN=ME,OU=Users,DC=childDomain,DC=forestRoot,DC=com’).Access | ft IdentityReference,AccessControlType -A
```

…and get this kind of output

```
IdentityReference AccessControlType

* * *

NT AUTHORITY\SELF Allow  
NT AUTHORITY\Authenticated Users Allow  
NT AUTHORITY\SYSTEM Allow  
S-1-5-32-548 Allow
```

…but wish for i.e. shows the service account has Write permission to attribute TargetAddress, etc. on the User object.

Any help is certainly appreciated here.

thanks

---

<div class="post-metadata">

**Author:** ![donj](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/donj/32/137_2.png) [@donj](https://forums.powershell.org/u/donj)\
**Post date:** [September 5, 2017, 3:40pm UTC](https://forums.powershell.org/t/determine-acls-on-ad-object/9297/2 "2017-09-05T15:40:29Z")

</div>

So, most of those permissions actually inherit from the base schema objects, not the actual AD objects. You’d have to get this from the schema, somehow, I suspect. The bigger problem is that the -ACL commands probably won’t get this for you - they’re not designed for the level of granularity that AD uses.

---

<div class="post-metadata">

**Author:** ![jeff-taylor](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/jeff-taylor/32/1015_2.png) [@jeff-taylor](https://forums.powershell.org/u/jeff-taylor)\
**Post date:** [September 6, 2017, 7:35pm UTC](https://forums.powershell.org/t/determine-acls-on-ad-object/9297/3 "2017-09-06T19:35:41Z")

</div>

so PowerShell 6? 🙂

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:37pm UTC](https://forums.powershell.org/t/determine-acls-on-ad-object/9297/4 "2024-05-16T20:37:37Z")

</div>