AD Permissions Reporter – Advanced Filter v2

The Advanced v2 filter offers a powerful way to locate specific permissions in Active Directory by defining the search scope and utilising a sophisticated query language.

Permissions Filter Advanced v2
The Filter Name is a user-friendly label for your saved filter. This name will appear in the list of saved filters, enabling you to identify and reuse complex queries easily.
Object Scope - is used to define the initial set of Active Directory objects to which the query will be applied. The query only runs against objects that match this scope.

  • Object Type Checkboxes: Select one or more object types (e.g., Users, Groups, OUs) to limit the search. Selecting All Objects includes all object classes.
  • LDAP Filter: For more granular control, you can provide a custom LDAP filter string. This is used in addition to any selected object types.
Search Scope - This determines the depth of the search from the starting directory container.

  • Base: Searches only the starting object itself.
  • One Level: Searches the immediate children of the starting object, but not the base object itself.
  • Sub Tree: Searches the starting object and all of its descendants at all levels.
Security Descriptor - This specifies which part of an object's security information to analyse.

  • DACL (Discretionary Access Control List): The default option, which contains the permissions (Allow/Deny ACEs).
  • SACL (System Access Control List): Contains the auditing rules (Success/Failure ACEs).
  • Mailbox: Specifically targets the msExchMailboxSecurityDescriptor for Exchange permissions.
  • Schema: Targets defaultSecurityDescriptor on a schema class object.
Query String - utilises a custom query language to evaluate the security descriptors of objects within the scope. The language supports logical operators, comparisons, grouping with parentheses, and a pre-processor for expanding special placeholders. The field has auto-complete functionality to help with query creation. For a comprehensive reference on syntax, keywords, and placeholders, please refer to the ACL Query Language Documentation.

Validation

The Validate button parses the query string without executing it. This allows you to check for syntax errors before running a potentially long search. If the syntax is correct, the message "Query Validated Successfully" will appear.

Also See:

AD Permissions Reporter
AD Permissions Reporter - Basic Filter 
Difference between v1 and v2 filters
ACL Query Language