1
# 找出没有任何直接子对象的 OU；只取一个对象就足以判断“非空”
2
Get-ADOrganizationalUnit -Filter * |
3
    ForEach-Object {
4
        $ou = $_
5
        $child = Get-ADObject -Filter * `
6
            -SearchBase $ou.DistinguishedName `
7
            -SearchScope OneLevel `
8
            -ResultSetSize 1
9

10
        if (-not $child) {
11
            $ou | Select-Object Name, DistinguishedName
12
        }
13
    }
14

15
# 按 VM 目录查询结果整理的格式示例，非 PowerShell 实机直出
16
Name     DistinguishedName
17
----     -----------------
18
User     OU=User,OU=Development,OU=Organization,DC=qy,DC=net
19
Computer OU=Computer,OU=Development,OU=Organization,DC=qy,DC=net

1
# 把 D:\Share 换成你要排查的实际目录；把根目录本身也纳入检查
2
$items = @(Get-Item -LiteralPath 'D:\Share') +
3
    @(Get-ChildItem -LiteralPath 'D:\Share' -Recurse -Force)
4

5
$items | ForEach-Object {
6
    $path = $_.FullName
7
    (Get-Acl -LiteralPath $path).Access |
8
        Where-Object { $_.IdentityReference.Value -match '^S-1-5-21-\d+-\d+-\d+-\d+$' } |
9
        Select-Object @{Name='Path';Expression={$path}},
10
            IdentityReference,FileSystemRights,AccessControlType
11
}
12

13
# 格式示例：本节未扫描实验环境中的 D:\Share
14
Path                   IdentityReference                         FileSystemRights AccessControlType
15
----                   -----------------                         ---------------- --------------
16
D:\Share\OldProject     S-1-5-21-111111111-222222222-333333333-1234 ReadAndExecute   Allow