Script to find out that users do not have inheritable permission checked

Question

Hi all,
I just check our AD (windows 2003 R2) and some users have "allow inheritable permissions from the parent to propagate to this object and all child objects.  include these with entries expilitly defined here" checked  if I open active directory
users and computers console and highlight this user and go to properties and select security and click advanced).  some users do not have ""allow inheritable permissions from the parent to propagate to this object and all child objects. " checked.
Is there a way to script to find out which users do not have "allow inheritable permissions from the parent to propagate to this object and all child objects. .." checked?
Thank you for your help.

Answer 1

There are several ways to use ADO in a VBScript program. The alternative below uses an ADO command object, so we can specify a "Page Size". This overcomes the 1000 (or 1500) limit on records returned, as it turns on paging. I have also modified
the script for comma delimited output. This script should be run at a command prompt so the output can be redirected to a text file. For example:
cscript //nologo FindUsers.vbs > report.csv
The modified script follows:
Option Explicit
Dim adoCommand, adoConnection, strBase, strFilter, strAttributes
Dim objRootDSE, strDNSDomain, strQuery, adoRecordset, strNTName, strDN
Dim objUser, objSecurityDescriptor, intNTSecDescCntrl, strInheritable
Const SE_DACL_PROTECTED = &H1000
' Setup ADO objects.
Set adoCommand = CreateObject("ADODB.Command")
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"
Set adoCommand.ActiveConnection = adoConnection
' Search entire Active Directory domain.
Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("defaultNamingContext")
strBase = "<LDAP://" & strDNSDomain & ">"
' Filter on user objects.
strFilter = "(&(objectCategory=person)(objectClass=user))"
' Comma delimited list of attribute values to retrieve.
strAttributes = "distinguishedName,sAMAccountName"
' Construct the LDAP syntax query.
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
adoCommand.CommandText = strQuery
adoCommand.Properties("Page Size") = 500
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False
' Run the query.
Set adoRecordset = adoCommand.Execute
' Enumerate the resulting recordset.
' Write a header line.
Wscript.Echo """NT Name"",""Distinguished Name"",""Allow inheritable permissions"""
Do Until adoRecordset.EOF
' Retrieve values.
strNTName = adoRecordset.Fields("sAMAccountName").Value
strDN = adoRecordset.Fields("distinguishedName").Value
strDN = Replace(strDN, "/", "\/")
Set objUser = GetObject("LDAP://" & strDN)
Set objSecurityDescriptor = objUser.Get("ntSecurityDescriptor")
intNtSecDescCntrl = objSecurityDescriptor.Control
If (intNtSecDescCntrl And SE_DACL_PROTECTED) <> 0 Then
strInheritable = "Disabled"
Else
strInheritable = "Enabled"
End If
Wscript.Echo """" & strNTName & """,""" & strDN & """," & strInheritable
' Move to the next record in the recordset.
adoRecordset.MoveNext
Loop
' Clean up.
adoRecordset.Close
adoConnection.Close
Richard Mueller
MVP ADSI