---

Если в отчёте не хватает деталей, можно напрямую проверить ACL ключевых объектов. Запустите на контроллере домена или машине с RSAT:

powershell
# Проверить ACL корня домена
$domainDN = (Get-ADDomain).DistinguishedName
(Get-Acl "AD:$domainDN").Access | Where-Object {
    $_.ActiveDirectoryRights -match "GenericAll|WriteDacl|WriteOwner|GenericWrite"
} | Select-Object IdentityReference, ActiveDirectoryRights, ObjectType, InheritedObjectType
Для AdminSDHolder:

powershell
$adminSDHolderDN = "CN=AdminSDHolder,CN=System," + (Get-ADDomain).DistinguishedName
(Get-Acl "AD:$adminSDHolderDN").Access | Where-Object {
    $_.ActiveDirectoryRights -match "GenericAll|WriteDacl|WriteOwner|GenericWrite"
} | Select-Object IdentityReference, ActiveDirectoryRights, ObjectType
Для каждого контроллера домена (OU Domain Controllers):

powershell
$dcOU = "OU=Domain Controllers," + (Get-ADDomain).DistinguishedName
(Get-Acl "AD:$dcOU").Access | Where-Object {
    $_.ActiveDirectoryRights -match "GenericAll|WriteDacl|WriteOwner|GenericWrite"
} | Select-Object IdentityReference, ActiveDirectoryRights