blocks|key|1282029|text|这和你要找的东西很接近。来源为您提供更多细节。使用Get-ACL的访问控制列表并不像有效访问+on+那样容易阅读，我不认为有什么方法可以绕过它。我确实认为，一旦习惯了它，Get-ACL就会给出更多的细节，当您知道您在寻找什么\+filter这些ACL来获取您想要的内容时。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|BOLD|entityRanges|data|1282030|代码|1282031|function+Get-EffectiveAccess+{
++++[CmdletBinding()]
++++param(
++++++++[Parameter(Mandatory,+ValueFromPipeline,+ValueFromPipelineByPropertyName)]
++++++++[ValidatePattern('(?:(CN=([%5E,]*)),)?(?:((?:(?:CN%7COU)=[%5E,]%2B,?)%2B),)?((?:DC=[%5E,]%2B,?)%2B)$')]
++++++++[alias('DistinguishedName')]
++++++++[string]+$Identity,

++++++++[parameter()]
++++++++[alias('Domain')]
++++++++[string]+$Server
++++)

++++begin+{
++++++++$guid++++=+[guid]::Empty
++++++++$GUIDMap+=+@{}

++++++++if($PSBoundParameters.ContainsKey('Server'))+{
++++++++++++$domain+=+Get-ADRootDSE+-Server+$Server
++++++++}
++++++++else+{
++++++++++++$domain+=+Get-ADRootDSE
++++++++}

++++++++$params+=+@{
++++++++++++SearchBase++=+$domain.schemaNamingContext
++++++++++++LDAPFilter++=+'(schemaIDGUID=*)'
++++++++++++Properties++=+'name',+'schemaIDGUID'
++++++++++++ErrorAction+=+'SilentlyContinue'
++++++++}
++++++++$adObjParams+=+@{
++++++++++++Properties+=+'nTSecurityDescriptor'
++++++++}

++++++++if($PSBoundParameters.ContainsKey('Server'))+{
++++++++++++$params['Server']++=+$Server
++++++++++++$adObjParams['Server']+=+$Server
++++++++}
++++++++$schemaIDs+=+Get-ADObject+@params

++++++++$params['SearchBase']+=+"CN=Extended-Rights,$($domain.configurationNamingContext)"
++++++++$params['LDAPFilter']+=+'(objectClass=controlAccessRight)'
++++++++$params['Properties']+=+'name',+'rightsGUID'
++++++++$extendedRigths+=+Get-ADObject+@params

++++++++foreach($i+in+$schemaIDs)+{
++++++++++++if(-not+$GUIDMap.ContainsKey([guid]+$i.schemaIDGUID))+{
++++++++++++++++$GUIDMap.Add([guid]+$i.schemaIDGUID,+$i.name)
++++++++++++}
++++++++}
++++++++foreach($i+in+$extendedRigths)+{
++++++++++++if(-not+$GUIDMap.ContainsKey([guid]+$i.rightsGUID))+{
++++++++++++++++$GUIDMap.Add([guid]+$i.rightsGUID,+$i.name)
++++++++++++}
++++++++}
++++}

++++process+{
++++++++try+{
++++++++++++$adObjParams['Identity']+=+$Identity
++++++++++++$object+=+Get-ADObject+@adObjParams

++++++++++++foreach($acl+in+$object.nTSecurityDescriptor.Access)+{
++++++++++++++++if($guid.Equals($acl.ObjectType))+{
++++++++++++++++++++$objectType+=+'All+Objects+(Full+Control)'
++++++++++++++++}
++++++++++++++++elseif($GUIDMap.ContainsKey($acl.ObjectType))+{
++++++++++++++++++++$objectType+=+$GUIDMap[$acl.ObjectType]
++++++++++++++++}
++++++++++++++++else+{
++++++++++++++++++++$objectType+=+$acl.ObjectType
++++++++++++++++}

++++++++++++++++if($guid.Equals($acl.InheritedObjectType))+{
++++++++++++++++++++$inheritedObjType+=+'Applied+to+Any+Inherited+Object'
++++++++++++++++}
++++++++++++++++elseif($GUIDMap.ContainsKey($acl.InheritedObjectType))+{
++++++++++++++++++++$inheritedObjType+=+$GUIDMap[$acl.InheritedObjectType]
++++++++++++++++}
++++++++++++++++else+{
++++++++++++++++++++$inheritedObjType+=+$acl.InheritedObjectType
++++++++++++++++}

++++++++++++++++[PSCustomObject]@{
++++++++++++++++++++Name++++++++++++++++++=+$object.Name
++++++++++++++++++++IdentityReference+++++=+$acl.IdentityReference
++++++++++++++++++++AccessControlType+++++=+$acl.AccessControlType
++++++++++++++++++++ActiveDirectoryRights+=+$acl.ActiveDirectoryRights
++++++++++++++++++++ObjectType++++++++++++=+$objectType
++++++++++++++++++++InheritedObjectType+++=+$inheritedObjType
++++++++++++++++++++InheritanceType+++++++=+$acl.InheritanceType
++++++++++++++++++++IsInherited+++++++++++=+$acl.IsInherited
++++++++++++++++}
++++++++++++}
++++++++}
++++++++catch+{
++++++++++++$PSCmdlet.WriteError($_)
++++++++}
++++}
}|code-block|syntax|javascript|1282032|示例|1282033|获得名为ExampleOU的组织单元的有效访问|unordered-list-item|1282034|Get-ADOrganizationalUnit+-Filter+"Name+-eq+'ExampleOU'"+%7C
++++Get-EffectiveAccess+%7C+Out-GridView|1282035|获取可信域上名为ExampleOU的组织单元的有效访问：|1282036|Get-ADOrganizationalUnit+-Filter+"Name+-eq+'ExampleOU'"+-Server+trustedDomain+%7C
++++Get-EffectiveAccess+-Server+trustedDomain+%7C+Out-GridView|1282037|与上面相同，但使用OU的DistinguishedName属性：|1282038|Get-EffectiveAccess+-Identity+'OU=ExampleOU,DC=domainName,DC=com'+%7C+Out-GridView|1282039|将名为exampleGroup的组的有效访问存储在变量中：|1282040|$effectiveAccess+=+Get-ADGroup+exampleGroup+%7C+Get-EffectiveAccess|1282041|有效地访问域中找到的前10个of：|1282042|Get-ADOrganizationalUnit+-Filter+*+%7C+Select+-First+10+%7C
++++Get-EffectiveAccess+%7C+Out-GridView|1282043|1282044|作为参考，这是完全控制在Get-ACL中的样子|1282045|​|1282046|📷|atomic|1282047|1282048|与对此OU具有写权限但不具有BUILTIN\Administrators完全控制的相比|1282049|1282050|1282051|1282052|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/santysq/Get-EffectiveAccess|1|IMAGE|IMMUTABLE|imageUrl|https://developer.qcloudimg.com/http-save/yehe-900000/2e2902a029c9adba4abbd10850a5d4ed.png|imageAlt|2|https://developer.qcloudimg.com/http-save/yehe-900000/4a71082cf54cee53ee996976facae255.png^0|P|7|2D|7|16|4|C|2|0|0|0|0|0|4|9|0|0|8|9|0|0|C|H|0|0|3|C|0|0|0|0|0|7|4|C|7|0|0|0|1|1|0|0|E|M|15|2|0|0|1|0|0|1|0|1|2|0|0|1|0^^$0|@$1|2|3|4|5|6|7|24|8|@$9|25|A|26|B|C]|$9|27|A|28|B|C]|$9|29|A|2A|B|D]]|E|@$9|2B|A|2C|1|2D]]|F|$]]|$1|G|3|H|5|6|7|2E|8|@]|E|@]|F|$]]|$1|I|3|J|5|K|7|2F|8|@]|E|@]|F|$L|M]]|$1|N|3|O|5|6|7|2G|8|@]|E|@]|F|$]]|$1|P|3|Q|5|R|7|2H|8|@$9|2I|A|2J|B|C]]|E|@]|F|$]]|$1|S|3|T|5|K|7|2K|8|@]|E|@]|F|$L|M]]|$1|U|3|V|5|R|7|2L|8|@$9|2M|A|2N|B|C]]|E|@]|F|$]]|$1|W|3|X|5|K|7|2O|8|@]|E|@]|F|$L|M]]|$1|Y|3|Z|5|R|7|2P|8|@$9|2Q|A|2R|B|C]]|E|@]|F|$]]|$1|10|3|11|5|K|7|2S|8|@]|E|@]|F|$L|M]]|$1|12|3|13|5|R|7|2T|8|@$9|2U|A|2V|B|C]]|E|@]|F|$]]|$1|14|3|15|5|K|7|2W|8|@]|E|@]|F|$L|M]]|$1|16|3|17|5|R|7|2X|8|@]|E|@]|F|$]]|$1|18|3|19|5|K|7|2Y|8|@]|E|@]|F|$L|M]]|$1|1A|3|O|5|6|7|2Z|8|@]|E|@]|F|$]]|$1|1B|3|1C|5|6|7|30|8|@$9|31|A|32|B|D]|$9|33|A|34|B|C]]|E|@]|F|$]]|$1|1D|3|1E|5|6|7|35|8|@]|E|@]|F|$]]|$1|1F|3|1G|5|1H|7|36|8|@]|E|@$9|37|A|38|1|39]]|F|$]]|$1|1I|3|1E|5|6|7|3A|8|@]|E|@]|F|$]]|$1|1J|3|1K|5|6|7|3B|8|@$9|3C|A|3D|B|D]|$9|3E|A|3F|B|D]]|E|@]|F|$]]|$1|1L|3|1E|5|6|7|3G|8|@$9|3H|A|3I|B|D]]|E|@]|F|$]]|$1|1M|3|1G|5|1H|7|3J|8|@$9|3K|A|3L|B|D]]|E|@$9|3M|A|3N|1|3O]]|F|$]]|$1|1N|3|1E|5|6|7|3P|8|@$9|3Q|A|3R|B|D]]|E|@]|F|$]]|$1|1O|3|-4|5|6|7|3S|8|@]|E|@]|F|$]]]|1P|$1Q|$5|1R|1S|1T|F|$1U|1V]]|1W|$5|1X|1S|1Y|F|$1Z|20|21|-4]]|22|$5|1X|1S|1Y|F|$1Z|23|21|-4]]]]

This is pretty close to what you're looking for. <a href="https://github.com/santysq/Get-EffectiveAccess" rel="nofollow noreferrer">Source</a> for more details. Access Control Lists with <code>Get-ACL</code> are not as easy to read as Effective Access on Advanced Security Settings and I don't think there is a way around that. I do think that, once used to it, <code>Get-ACL</code> gives a lot more details when you know what you're looking for \ filter the ACLs to get what you're looking for.
<h3>Code</h3>
<pre><code>function Get-EffectiveAccess {
 [CmdletBinding()]
 param(
 [Parameter(Mandatory, ValueFromPipeline, ValueFromPipelineByPropertyName)]
 [ValidatePattern('(?:(CN=([^,]*)),)?(?:((?:(?:CN|OU)=[^,]+,?)+),)?((?:DC=[^,]+,?)+)$')]
 [alias('DistinguishedName')]
 [string] $Identity,

 [parameter()]
 [alias('Domain')]
 [string] $Server
 )

 begin {
 $guid = [guid]::Empty
 $GUIDMap = @{}

 if($PSBoundParameters.ContainsKey('Server')) {
 $domain = Get-ADRootDSE -Server $Server
 }
 else {
 $domain = Get-ADRootDSE
 }

 $params = @{
 SearchBase = $domain.schemaNamingContext
 LDAPFilter = '(schemaIDGUID=*)'
 Properties = 'name', 'schemaIDGUID'
 ErrorAction = 'SilentlyContinue'
 }
 $adObjParams = @{
 Properties = 'nTSecurityDescriptor'
 }

 if($PSBoundParameters.ContainsKey('Server')) {
 $params['Server'] = $Server
 $adObjParams['Server'] = $Server
 }
 $schemaIDs = Get-ADObject @params

 $params['SearchBase'] = &quot;CN=Extended-Rights,$($domain.configurationNamingContext)&quot;
 $params['LDAPFilter'] = '(objectClass=controlAccessRight)'
 $params['Properties'] = 'name', 'rightsGUID'
 $extendedRigths = Get-ADObject @params

 foreach($i in $schemaIDs) {
 if(-not $GUIDMap.ContainsKey([guid] $i.schemaIDGUID)) {
 $GUIDMap.Add([guid] $i.schemaIDGUID, $i.name)
 }
 }
 foreach($i in $extendedRigths) {
 if(-not $GUIDMap.ContainsKey([guid] $i.rightsGUID)) {
 $GUIDMap.Add([guid] $i.rightsGUID, $i.name)
 }
 }
 }

 process {
 try {
 $adObjParams['Identity'] = $Identity
 $object = Get-ADObject @adObjParams

 foreach($acl in $object.nTSecurityDescriptor.Access) {
 if($guid.Equals($acl.ObjectType)) {
 $objectType = 'All Objects (Full Control)'
 }
 elseif($GUIDMap.ContainsKey($acl.ObjectType)) {
 $objectType = $GUIDMap[$acl.ObjectType]
 }
 else {
 $objectType = $acl.ObjectType
 }

 if($guid.Equals($acl.InheritedObjectType)) {
 $inheritedObjType = 'Applied to Any Inherited Object'
 }
 elseif($GUIDMap.ContainsKey($acl.InheritedObjectType)) {
 $inheritedObjType = $GUIDMap[$acl.InheritedObjectType]
 }
 else {
 $inheritedObjType = $acl.InheritedObjectType
 }

 [PSCustomObject]@{
 Name = $object.Name
 IdentityReference = $acl.IdentityReference
 AccessControlType = $acl.AccessControlType
 ActiveDirectoryRights = $acl.ActiveDirectoryRights
 ObjectType = $objectType
 InheritedObjectType = $inheritedObjType
 InheritanceType = $acl.InheritanceType
 IsInherited = $acl.IsInherited
 }
 }
 }
 catch {
 $PSCmdlet.WriteError($_)
 }
 }
}
</code></pre>
<h3>Examples</h3>
<ul>
<li>Get the Effective Access of the Organizational Unit named <code>ExampleOU</code>:</li>
</ul>
<pre class="lang-bash prettyprint-override"><code>Get-ADOrganizationalUnit -Filter &quot;Name -eq 'ExampleOU'&quot; |
 Get-EffectiveAccess | Out-GridView
</code></pre>
<ul>
<li>Get the Effective Access of the Organizational Unit named <code>ExampleOU</code> on a Trusted Domain:</li>
</ul>
<pre class="lang-bash prettyprint-override"><code>Get-ADOrganizationalUnit -Filter &quot;Name -eq 'ExampleOU'&quot; -Server trustedDomain |
 Get-EffectiveAccess -Server trustedDomain | Out-GridView
</code></pre>
<ul>
<li>Same as above but using the OU's <code>DistinguishedName</code> attribute:</li>
</ul>
<pre class="lang-bash prettyprint-override"><code>Get-EffectiveAccess -Identity 'OU=ExampleOU,DC=domainName,DC=com' | Out-GridView
</code></pre>
<ul>
<li>Store the Effective Access of the group named <code>exampleGroup</code> in a variable:</li>
</ul>
<pre class="lang-bash prettyprint-override"><code>$effectiveAccess = Get-ADGroup exampleGroup | Get-EffectiveAccess
</code></pre>
<ul>
<li>Get the Effective Access of the first 10 OUs found in the Domain:</li>
</ul>
<pre class="lang-bash prettyprint-override"><code>Get-ADOrganizationalUnit -Filter * | Select -First 10 |
 Get-EffectiveAccess | Out-GridView
</code></pre>
<h3>Sample</h3>
For reference, this is how Full Control looks like with <code>Get-ACL</code>
<a href="https://i.stack.imgur.com/fDGAy.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/fDGAy.png" alt="fullcontrol" /></a>
Compared with BUILTIN\Administrators which has write permissions on this OU but not Full Control
<a href="https://i.stack.imgur.com/Ea1JA.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Ea1JA.png" alt="writepermissions" /></a>

blocks|key|1710702|text|您可以尝试使用PowerShellAccessControl模块，我认为这个模块的详细信息在这个youtube视频中包含了Get-EffectiveAccess函数。这应该能帮你得到信息。该模块已从微软PS画廊中删除。我不知道你怎么能从Github安装这个模块，我无法尝试，因为我正在使用Mac。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1710703|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/rohnedwards/PowerShellAccessControl|1|https://youtu.be/G4bptl-H8PU?t=2423|2|https://gallery.technet.microsoft.com/scriptcenter/PowerShellAccessControl-d3be7b83/file/136752/1/PowerShellAccessControl_v4.0_preview_20150417.zip^0|1P|J|7|N|0|1C|9|1|2R|6|2|0^^$0|@$1|2|3|4|5|6|7|R|8|@$9|S|A|T|B|C]]|D|@$9|U|A|V|1|W]|$9|X|A|Y|1|Z]|$9|10|A|11|1|12]]|E|$]]|$1|F|3|-4|5|6|7|13|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]|N|$5|I|J|K|E|$L|O]]|P|$5|I|J|K|E|$L|Q]]]]

You can try <a href="https://github.com/rohnedwards/PowerShellAccessControl" rel="nofollow noreferrer">PowerShellAccessControl</a> module I think the details for this module are covered in this <a href="https://youtu.be/G4bptl-H8PU?t=2423" rel="nofollow noreferrer">youtube video</a> with the function <code>Get-EffectiveAccess</code>. This should help you get the information. The module has been deleted from the <a href="https://gallery.technet.microsoft.com/scriptcenter/PowerShellAccessControl-d3be7b83/file/136752/1/PowerShellAccessControl_v4.0_preview_20150417.zip" rel="nofollow noreferrer">Microsoft's PS Gallery</a>. I am not sure how you might be able to install the module from Github, I couldn't try it as I am working with a Mac.

I am trying to get effective permissions of certain active directory users on various Active Directory objects. I can see these permissions from the UI - <a href="https://i.stack.imgur.com/Fx6WD.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Fx6WD.png" alt="enter image description here" /></a>
I am trying to get this using Powershell. I have already tried <code>dsacls</code> and <code>Get-Acls</code> but these don't give effective permissions. These both give &quot;who has access/permissions&quot; which is not the same as &quot;who has what effective permissions&quot;. These also don't list out all the granular details that would provide context around the effective access.
Any pointers on how this can be achieved programmatically would be really appreciated.
Update -
Effective permissions here would mean which permissions are allowed to the object in reality based on inheritances or other rules set at a different level.
For example -
All the properties in the below example are not visible with Get-ACL.
<a href="https://i.stack.imgur.com/E5mpm.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/E5mpm.png" alt="enter image description here" /></a>
Another example of what Get-Acl shows while the UI tells differently is when I pulled permissions for domain admins on one of the OUs via Get-ACL , after resolving the values in ObjectType and InheritedObjectType (use get-effective access function mentioned by Santiago Squarzon) I get -
<a href="https://i.stack.imgur.com/bZAoC.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/bZAoC.png" alt="enter image description here" /></a>
While the UI effective access shows-
<a href="https://i.stack.imgur.com/n4O3q.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/n4O3q.png" alt="enter image description here" /></a>
My end goal is to get all the permission in the above screenshot using powershell.

Effective Access Active Directory Object Using PowerShell

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我试图获得某些活动目录用户对各种active对象的有效权限。我可以从UI中看到这些权限-​我正试着用Powershell实现这个。我已经尝试过dsacls和Get-Acls，但是这些都没有提供有效的权限。这两者都给出了“谁拥有访问/权限”，这与“谁有什么有效权限”不一样。这些文件也没有列出为有效访问提供上下文的所有细节...

问使用PowerShell有效访问Active对象
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用PowerShell有效访问Active对象EN