get-rbcd-opportunities

gistfile1.txt

# Import the Active Directory module
Import-Module ActiveDirectory

# Define the domain name
$domainName = "yourdomain.com"

# Get all computer objects in the domain
$computerObjects = Get-ADComputer -Filter * -SearchBase "DC=$($domainName.Replace('.',',DC='))" -Properties Name

# Iterate over each computer object
foreach ($computerObject in $computerObjects) {
    $acl = Get-Acl -Path ("AD:\$($computerObject.DistinguishedName)")

    # Check each access rule in the ACL
    foreach ($accessRule in $acl.Access) {
        if (($accessRule.ActiveDirectoryRights -eq 'GenericAll') -or ($accessRule.ActiveDirectoryRights -eq "GenericWrite")) {

            # Check if the principal of the access rule is a computer object
            try {
                $foundComputer = Get-ADComputer -Filter {DistinguishedName -eq $accessRule.IdentityReference.Value} -ErrorAction SilentlyContinue

                if($foundComputer) {
                    Write-Host "Object Name: $($computerObject.Name)"
                    Write-Host "Principal Name: $($accessRule.IdentityReference)"
                    Write-Host "Extended Rights: $($accessRule.ActiveDirectoryRights)"
                    Write-Host
                }
            } 
            catch {
                # If there is an error (other than the computer not being found), this will catch the error
                Write-Warning "An error occurred while checking if $($accessRule.IdentityReference.Value) is a computer object. Details: $($_.Exception.Message)"
            }
        }
    }
}