title: How to I list the permissions on Active Directory Computer Object for "Validated write to service principal name" and "write service principal name"
body: <p>Can someone please help me with the following</p>
  
  <p>I am trying to do something very similar to this post</p>
  
  <p><a href="https://stackoverflow.com/questions/4156743/powershell-how-do-you-set-the-read-write-service-principal-name-ad-permissions/41945360#41945360">Powershell: How do you set the Read/Write Service Principal Name AD Permissions?</a></p>
  
  <p>Basically I do not need to set/change rights but rather read rights</p>
  
  <p>On a Computer object in AD (Active Directory) you 'Allow' a User, Group or Computer object (either the same computer or another computer object) the 'Write' right to the following property/attribute of the computer object</p>
  
  <p><strong>Validated write to service principal name</strong> and <strong>write service principal name</strong> </p>
  
  <p>So lets say on Computer object Server01 the user Domain\Fred is 'Allowed' to  "Validated write to service principal name" and also 'Allowed' the "write service principal name"</p>
  
  <p>And Paul, John and Susan all have the same rights as Fred</p>
  
  <p>now lets say I have 500 computers in the AD Domain with a combination of the above rights</p>
  
  <p>I want to get the computer objects (I know how to do this with PowerShell or ADSI, .NET) </p>
  
  <p>then I want to list out who has the above rights to these computer objects (and that is the bit I am stuck on) how to <strong>list</strong> out the rights (rather the checking each user, group and computer one at a time to see if they have the these rights or not) to see who can set these SPN related values for the computers in my domain.</p>
  
  <p>Thanks very much in advance
  __AAnotheruser  </p>