Finds permissions that specified user has on specified AD object (computer or user account).
Get-AdmPwdUserPermissions [-ObjectName] <String> [-UserUPN] <String> [[-ForestDnsName] <String>] [<CommonParameters>]
Finds permissions that specified user has on specified computer or user account.
Cmdlet uses the same logic that uses PDS for authorization decisions for password reading, so it may be useful when investigating why user has / does not have permission top read the password.
Cmdlet returns permission entries that influence ability to read password, in order used by PDS when evaluating user's permissions - this means that first permission in the list is an effective permission.
Kerberos S4U2S logon is used to retrieve identification token of user, along with security groups user is member of.
Groups in token, and identity of user are used to find matching entries in ACL on AD object.
Matching entries are then ordered (deny entries first and entries for identity of user first) and returned in resulting order.
Get-AdmPwdUserPermissions -ObjectName:MyComputer -UserUPN:myUser@mydomain.com
Gets effective permissions as seen by PDS for myUser on MyComputer in local forest of PDS
Name of the computer or user account to get effective permissions for
Type: String Parameter Sets: (All) Aliases: Required: True Position: 0 Default value: None Accept pipeline input: True (ByValue) Accept wildcard characters: False
userPrincipalName of user to get effective permissions for
Type: String Parameter Sets: (All) Aliases: Required: True Position: 1 Default value: None Accept pipeline input: False Accept wildcard characters: False
DNS Name of AD forest where to find. If not specified, forest where PDS is installed is used.
Type: String Parameter Sets: (All) Aliases: Required: False Position: 2 Default value: None Accept pipeline input: False Accept wildcard characters: False
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
Caller does not have specific permissions delegated.
Call is not audited.
UserUPN parameter only accepts user identity as UPN. Other formats (such as domain\user) are not accepted.