joeware - never stop exploring...

This question comes up so often I decided to write a little something something on it so I can point people at it instead of rewriting the answer.
So let’s say the questions comes in like
Question:
How do I query AD for all users (or objects or whatever) that don’t have “Allow inheritable permissions to propagate to [...]

I have released an update to AdFind. The new version is V01.35.00. The following changes are included:

Fixed bug in -onlydacl
Fixed bug in -sddl for ACL flag output
Added shortcut DomainNCs
Changed output of ACL Flag output for -sddl++
Added -onlydaclflag, -onlysaclflag, -onlyaclflags

I think folks will like the -onlydaclflag switch once they realize how useful it can be. [...]