# Inventory OUs with ACL (Disable Inheritance)

**URL:** <https://forums.powershell.org/t/inventory-ous-with-acl-disable-inheritance/15333>\
**Category:** PowerShell Help\
**Created:** [December 3, 2020, 12:21pm UTC](https://forums.powershell.org/t/inventory-ous-with-acl-disable-inheritance/15333 "2020-12-03T12:21:36Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeff-taylor](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/jeff-taylor/32/1015_2.png) [@jeff-taylor](https://forums.powershell.org/u/jeff-taylor)\
**Post date:** [December 3, 2020, 12:21pm UTC](https://forums.powershell.org/t/inventory-ous-with-acl-disable-inheritance/15333/1 "2020-12-03T12:21:36Z")

</div>

I’m trying to get a script working for giving me info about Inheritance Disabled at the _ACL_ level (not whether GPOs are being blocked)

I’ve been playing with two one-liners and feel I’m getting close but now the data is either incomplete or unintended.

This works but is only giving GPO related info

```
Get-ADOrganizationalUnit -SearchBase "OU=PARENT,DC=company,DC=com"-SearchScope OneLevel -Filter * | ft DistinguishedName,@{Name="Inheritance";Expression={(Get-GPInheritance$_.DistinguishedName).GpoInheritanceBlocked}} -Autosize
```

I see this (but again, it’s about GPOs)

```
Get-ADOrganizationalUnit -SearchBase "OU=PARENT,DC=company,DC=com"-SearchScope OneLevel -Filter * | ft DistinguishedName,@{Name="Inheritance";Expression={(Get-GPInheritance$_.DistinguishedName).GpoInheritanceBlocked}} -Autosize

LinkedGroupPolicyObjects Property Microsoft.ActiveDirectory.Management.ADPropertyValueCollection LinkedGroupPolicyObjects {get;}
```

am I barking up the wrong cmdlet?

---

<div class="post-metadata">

**Author:** ![rob-simmers](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/rob-simmers/32/1010_2.png) [@rob-simmers](https://forums.powershell.org/u/rob-simmers)\
**Post date:** [December 3, 2020, 3:33pm UTC](https://forums.powershell.org/t/inventory-ous-with-acl-disable-inheritance/15333/2 "2020-12-03T15:33:59Z")

</div>

Does this work?

```
Get-ADOrganizationalUnit -SearchBase "OU=PARENT,DC=company,DC=com" -SearchScope OneLevel -Filter * | 
Select-Object Name, 
              DistinguishedName,
              @{Name="GpoInheritanceBlocked";Expression={(Get-GPInheritance -Target $_.DistinguishedName) | Select-Object -ExpandProperty GpoInheritanceBlocked}}
```

---

<div class="post-metadata">

**Author:** ![jeff-taylor](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/jeff-taylor/32/1015_2.png) [@jeff-taylor](https://forums.powershell.org/u/jeff-taylor)\
**Post date:** [December 4, 2020, 10:32am UTC](https://forums.powershell.org/t/inventory-ous-with-acl-disable-inheritance/15333/3 "2020-12-04T10:32:30Z")

</div>

Hi Rob, yes your code accurately captures Blocks at the _GPO_ level…(thank you)

…but I’d like to know if PowerShell can capture Inheritance on ACLs set on an OU.

(Not sure how to uploaded a jpg)  
DSA.msc \> right click on an OU \> Properties \> security \> Advanced \> I want to see wherever it says “Enable Inheritance”

…Also, your code made me realize one thing as well. If I go deeper in the subtrees, I’ll see a lot of Get-GPInheritance -eq “False”. If I want to winnow that to only “True” this is what I’ve tried:

```
Get-ADOrganizationalUnit -SearchBase "OU=PARENT,DC=company,DC=com" -SearchScope OneLevel -Filter * | 
Select-Object Name, DistinguishedName,@{Name="GpoInheritanceBlocked";Expression={(Get-GPInheritance -Target $_.DistinguishedName) | Select-Object -ExpandProperty GpoInheritanceBlocked | Where-Object -Value -eq "True" }}
```

…I get no errors but I get no results either (and know they are there).

---

<div class="post-metadata">

**Author:** ![hudzon](https://avatars.discourse-cdn.com/v4/letter/h/a88e4f/32.png) [@hudzon](https://forums.powershell.org/u/hudzon)\
**Post date:** [December 5, 2020, 6:12pm UTC](https://forums.powershell.org/t/inventory-ous-with-acl-disable-inheritance/15333/4 "2020-12-05T18:12:28Z")

</div>

try

Where-Object {$\_.value -eq “True”}

---

<div class="post-metadata">

**Author:** ![rob-simmers](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/rob-simmers/32/1010_2.png) [@rob-simmers](https://forums.powershell.org/u/rob-simmers)\
**Post date:** [December 7, 2020, 6:03am UTC](https://forums.powershell.org/t/inventory-ous-with-acl-disable-inheritance/15333/5 "2020-12-07T06:03:56Z")

</div>

Never done this before, but would assume if you want ACL Permissions you most likely need to use Get-ACL:

> **[Use PowerShell to Explore Active Directory Security](https://devblogs.microsoft.com/scripting/use-powershell-to-explore-active-directory-security/)**
>
> Summary: Learn how to use Windows PowerShell to explore Active Directory Security settings on objects.  Hey, Scripting Guy! I have a problem. My boss told me I need to document the access rights for objects that are in Active Directory. I have...

---

<div class="post-metadata">

**Author:** ![jeff-taylor](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/jeff-taylor/32/1015_2.png) [@jeff-taylor](https://forums.powershell.org/u/jeff-taylor)\
**Post date:** [December 10, 2020, 12:27pm UTC](https://forums.powershell.org/t/inventory-ous-with-acl-disable-inheritance/15333/6 "2020-12-10T12:27:42Z")

</div>

I tested for “False” (as I know they exist) but no results were returned

```
Get-ADOrganizationalUnit -SearchBase "OU=PARENT,DC=corp,DC=com" -SearchScope OneLevel -Filter * | 
Select-Object Name, DistinguishedName,@{Name="GpoInheritanceBlocked";Expression={(Get-GPInheritance -Target $_.DistinguishedName) | Select-Object -ExpandProperty GpoInheritanceBlocked }} | Where-Object {$_.value -eq “False”}
```

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:28pm UTC](https://forums.powershell.org/t/inventory-ous-with-acl-disable-inheritance/15333/7 "2024-05-16T20:28:09Z")

</div>