SERVER-012 · Script

Audit Directory Access Controls

Finds directory permissions that give control over OUs or the domain to accounts you did not expect.

Version 1.0.0Language PowerShellUpdated November 2026Report only, changes nothing

What it does

Reads the permission list on the domain root, the AdminSDHolder object (which protects admin accounts), and every OU under -SearchBase. It reports permissions that were added directly on the object (not inherited) and that allow strong control: full control, write all properties, change permissions, take ownership, create or delete child objects, reset passwords, all extended rights, or directory replication Entries for built-in administrative principals (SYSTEM, Administrators, Domain Admins, Enterprise Admins, Schema Admins, domain controllers, SELF, CREATOR OWNER) are treated as expected. Add your own approved groups with -ApprovedPrincipals, for example a help desk group that is supposed to reset passwords in the Students OU. Read-only; changes nothing.

Requirements

Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). Any domain account can usually read permissions.

How to run it

Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
Script type: PowerShell 5.1, 64-bit
User interaction: none; the script never prompts
Timeout: 30 minutes for large directories or many servers

Settings

Name	What it does	Options	Default
SearchBase	OU (distinguished name) whose OUs are checked. If empty, every OU in the domain.
ApprovedPrincipals	Extra accounts or groups (DOMAIN\Name or SID) that are expected to hold these permissions.		(none)
IncludeDenied	Also list explicit Deny entries. Off by default.		False
AlertOn	Unexpected (default) exits 1 when unexpected entries are found. Never always exits 0.	Unexpected, Never	Unexpected
Server	Optional domain controller to read from.

Exit codes

0 = No unexpected entries (or AlertOn is Never)
1 = Unexpected entries found
2 = Script error (see log)

Testing steps

Run it on one test OU, test account or test server and check the output and log.
Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
Roll out to a small group next, then everyone.

Rollback steps

Report only. Nothing is changed, so nothing needs to be rolled back.

Version and change log

Version	Date	Changes
1.0.0	November 2026	First release.