Home / server / Questions / 676852
In Process
BastianW
Asked: 2015-03-20 13:40:04 +0800 CST

Check deletion rights on AD object via powershell?

  • 772

I need to build a script which check if the current user has rights to delete a special AD object and if this is the case the powershell script can delete it.

Deleting an AD object isn´t the issue, the question I have is more how to check if the current user (which runs the script) has the right to do so? Use a try/catch seamed not the best way I think.

Any good idea?

powershell

1 Answers

  1. That thread Tim linked has good info, here is a native way:

    (Get-Acl -Path "AD:\CN=John Doe,OU=Users,DC=contoso,DC=com" | `
select -ExpandProperty Access) | `
select ActiveDirectoryRights,IdentityReference

    With that, you should be able to get that into an Object and compare the user you're working as with -contains.

    Here are a couple blogs from Microsoft MVPs on this:

    Ashley McGlone

    Hey, Scripting Guy

    • 1