Get-ObjectAcl -SamAccountName "users" -ResolveGUIDs | select IdentityReference, ActiveDirectoryRights
Get-ObjectAcl -SamAccountName "Domain Admins" -ResolveGUIDs | select ObjectDN, ActiveDirectoryRights
Get-NetGPO | %{Get-ObjectAcl -ResolveGUIDs -Name $_.Name}
Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentityReference -match "RDPUsers"}