A language independent(!) Powershell Script to remove orphaned AdminCount=1 on User objects in Active Directory and enable ACL inheritance from parent OU. Repair/Cleanup User Accounts, protected by sdprop/AdminSDHolder process in Active Directory, that are no longer Member of one of the Protected Groups.
The Script doesn´t work initialliy with the displayname of the the group. The problem is, that´s a localized name and there is more than english.
The script uses the best common denominator: The Well-Known SID. Simple as that. The report of group membership is the localized version of the group.
Groups protected by sdprop (AdminSDHolder) process.
- Account Operators
- Administrator
- Administrators
- Backup Operators
- Domain Admins
- Domain Controllers
- Enterprise Admins
- Enterprise Key Admins
- Key Admins
- Krbtgt
- Print Operators
- Read-only Domain Controllers
- Replicator
- Schema Admins
- Server Operators
Call Script in "Report Only" mode:
.\Cleanup-AdminCount.ps1
Call Script in "Clean Up and repair" mode:
.\Cleanup-AdminCount.ps1 -cleanup
Running Script - Both modi:
Appendix C: Protected Accounts and Groups in Active Directory