Skip to content

Commit 09dde32

Browse files
committed
adds examples to docs
1 parent 46e46b2 commit 09dde32

File tree

1 file changed

+36
-3
lines changed

1 file changed

+36
-3
lines changed

docs/en-US/Get-ADEffectiveAccess.md

Lines changed: 36 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,13 +51,45 @@ Unlike `Get-Acl`, there is no dependency on the Active Directory module and incl
5151

5252
## EXAMPLES
5353

54-
### Example 1
54+
### Example 1: Get ACL for a specific user by sAMAccountName
5555

56+
```powershell
57+
PS \> Get-ADEffectiveAccess -Identity John.Doe
58+
```
59+
60+
Retrieves the effective access rules for the user `John.Doe` in the current domain.
61+
62+
### Example 2: Get ACLs for all users in an OU with audit rules
63+
64+
```powershell
65+
PS \> Get-ADEffectiveAccess -LdapFilter "(objectCategory=person)" -SearchBase "OU=Users,DC=mylab,DC=local" -Audit
66+
```
67+
68+
Retrieves access and audit rules for all user objects in the `Users` OU, including system access control list (SACL) rules.
69+
70+
### Example 3: Pipe AD user object to retrieve ACL
71+
72+
```powershell
73+
PS \> Get-ADUser -Identity "jdoe" | Get-ADEffectiveAccess
74+
```
75+
76+
Uses pipeline input from `Get-ADUser` to retrieve effective access rules for the user `jdoe`.
77+
78+
### Example 4: Get ACLs for deleted objects with a limit
79+
80+
```powershell
81+
PS \> Get-ADEffectiveAccess -LdapFilter "(objectClass=group)" -IncludeDeletedObjects -Top 10
5682
```
57-
PS C:\> {{ Add example code here }}
83+
84+
Retrieves access rules for up to 10 deleted `group` objects in the domain, including tombstone objects.
85+
86+
### Example 5: Query ACLs on a specific server with custom authentication
87+
88+
```powershell
89+
PS \> Get-ADEffectiveAccess -LdapFilter "(objectClass=computer)" -Server "myChildDomain.local:636" -AuthenticationTypes Secure, FastBind
5890
```
5991

60-
{{ Add example description here }}
92+
Retrieves access rules for all `computer` objects in a child domain with secure authentication and fast bind.
6193

6294
## PARAMETERS
6395

@@ -159,6 +191,7 @@ Specifies the AD DS instance to connect to. Accepts:
159191
- Fully qualified domain name
160192
- NetBIOS name
161193
- Directory server name (with optional port, e.g. `myDC01:636`)
194+
- Global Catalog (e.g. `GC://myDomain`)
162195

163196
Defaults to the current domain if not specified.
164197

0 commit comments

Comments
 (0)