Get the name of the Active Directory object referenced in the InheritedObjectType property of an ActiveDirectoryAccessRule using PowerShell

You may find when you access the nTSecurityDescriptor property using the Active Directory PowerShell cmdlets it returns a System.DirectoryServices.ActiveDirectoryAccessRule object that has a InheritedObjectType property set to a GUID value.

ActiveDirectoryRights : Self, WriteProperty
InheritanceType       : Descendents
ObjectType            : 00000000-0000-0000-0000-000000000000
InheritedObjectType   : bf967aba-0de6-11d0-a285-00aa003049e2
ObjectFlags           : InheritedObjectAceTypePresent
AccessControlType     : Allow
IdentityReference     : NT AUTHORITY\BATCH
IsInherited           : False
InheritanceFlags      : ContainerInherit
PropagationFlags      : InheritOnly

This corresponds to the applies to inheritance and propagation settings on the security object, defining the types of descendant objects to which the permission applies.

The value is actually the SchemaIDGUID value of the schema object which it represents. To resolve the GUID to a name you need to query the Active Directory schema passing the GUID in encoded hex format. 

The following function performs the resolution.

# Gets the schema name of the schema object with the specified schema identifier GUID (SchemaIDGUID).
Function Get-ActiveDirectorySchemaObjectName
{     
    [CmdletBinding()]
    param(
       
        [Parameter()]
        [System.Guid] $Identifier
    )
    process
    {
        $bytes = $Identifier.ToByteArray();
        $hexString = "\$(($bytes|ForEach-Object ToString X2) -join '\')";
        $schemaNamingContext = (Get-ADRootDSE).SchemaNamingContext;
        $results = Get-ADObject -SearchBase $schemaNamingContext -LDAPFilter "(SchemaIDGUID=$hexString)";
        return $results.Name;
    }
} 

 While you're here -
Why not check out our Active Directory Documentation Tool?