Enable AD Object Inheritance using Powershell

In Active Directory (AD), object inheritance controls how permissions are passed down from parent Organizational Units (or OUs) to the objects within them. By default, AD objects inherit permissions from their parent container unless inheritance is explicitly disabled.

In certain cases, such as with privileged accounts that have their adminCount attribute set to 0 due to changes in their privilege level, we may find object inheritance is disabled on those objects. This can lead to issues where permissions are not inherited as expected, potentially causing inconsistent access controls. For these situations, we may need to explicitly re-enable inheritance.

Here’s an easy way to enable (or disable) AD object inheritance using PowerShell. This script allows you to automate the process and apply it to multiple AD objects at once.

#$users = Get-ADUser -ldapfilter “(objectclass=user)” -searchbase “DC=domain,DC=local”
$users = get-aduser JohnDo #test with a single user first

ForEach($user in $users)
{
    $dn= [ADSI](“LDAP://” + $user)
    $acl= $dn.psbase.objectSecurity
    if ($acl.get_AreAccessRulesProtected())
    {
        $isProtected = $false # $false to enable inheritance
                              # $true to disable inheritance
        $preserveInheritance = $true # $true to keep inherited access rules
                                     # $false to remove inherited access rules.
                                     # ignored if isProtected=$false
        $acl.SetAccessRuleProtection($isProtected, $preserveInheritance)
        $dn.psbase.commitchanges()
        Write-Host($user.SamAccountName + "|" + `
                   $user.DistinguishedName + `
                   "|inheritance set to enabled")
    }
    else
    {
        write-host($user.SamAccountName + "|" + `
                   $user.DistinguishedName + `
                   "|inheritance already enabled")
    }
}

For more information please refer to SetAccessRuleProtection Method.

Happy scripting!