Active Directory Permissions Report | PowerShell Script | Groups, Nested Members, Delegated Rights | Read-Only

A PowerShell script that shows who belongs to which group (even nested groups) and who has delegated rights in Active Directory – on organizational units, domain objects, and group policies. It includes 14 checkpoints, a clear HTML report in German with explanations and recommendations, and optionally, a CSV file for Excel containing all memberships and rights.

THIS IS INCLUDED
• PowerShell script Enforcement Report.ps1 (open source code, commented)
• Instructions as PDF
• Sample report of a test domain (HTML)

THE SCRIPT ONLY WORKS IN READING TIME
It does not change permissions, groups, or objects, and it does not transfer any data. A normal domain account is sufficient; administrator rights are not required.

THE 14 CHECKPOINTS
• Domain: Replication rights (DCSync) outside of standard accounts; Extensive rights on the domain object and all objects below it; Additional rights on AdminSDHolder; Permissions not readable; Exchange group rights on the domain object (default, for informational purposes only)
• Delegation: Write permissions for Everyone, Authenticated Users, or Domain Users; inventory of all delegated rights across domains, organizational units, and containers; rights directly to individual user accounts; rights for deleted accounts (orphaned SIDs); owner is not an administrator group; organizational units with inheritance disabled
• Group policies and groups: Group policies that non-administrators are allowed to edit; groups that abstain from voting; accounts in a very large number of groups

REQUIREMENTS
• Windows PowerShell 5.1
• PowerShell module ActiveDirectory (present on domain controllers, otherwise RSAT)
• Tested with Windows PowerShell 5.1 on Windows Server 2025 in a test domain (approximately 30 users, 60 groups, 8 organizational units), as an administrator and as a regular user; each checkpoint was triggered with a simulated scenario. Very large directories, multiple domains, and trust relationships were not tested.

FOR WHOM
Administrators and IT service providers who need to prove to auditors, insurance companies, or for their own documentation who is allowed to do what in Active Directory.

GOOD TO KNOW
• Digital download (ZIP and PDF) – no physical product will be shipped
• Language of script output, report and instructions: German
• The report identifies anomalies based on fixed rules; it does not replace security audits or monitoring.
• Use within your own company or for your own customers; no resale
• Use at your own risk

Note: Content and structure originate from the seller; AI tools were used to assist in its development. All content has been professionally reviewed by the seller.