DSREVOKE.EXE can report or remove permissions assigned to a specified user or group on organizational units (OUs). It is a legacy command-line utility: Microsoft’s published requirements name Windows 2000, Windows XP Professional, and Windows Server 2003, with Windows 2000 or Windows Server 2003 Active Directory domain controllers as targets. Those requirements do not establish support on current Windows releases.
Use it cautiously: first report the principal’s explicit permissions, review what the command finds and confirm the intended scope, then decide whether removal is appropriate.
As an Amazon Associate I earn from qualifying purchases.
What DSREVOKE does—and what it does not do
Microsoft describes DSREVOKE as a way to report permissions for a specified user or group on a set of OUs and optionally remove that principal’s permissions from those OUs’ discretionary access control lists (DACLs). It is intended to help revoke delegated administrative authority and complements the Delegation of Control Wizard. Microsoft’s description is specifically about OUs and a named principal; it does not establish DSREVOKE as a general-purpose editor or complete audit tool for every Active Directory object or naming context. Microsoft Download Center: DSREVOKE.EXE
“Dsrevoke complements the functionality provided by the Delegation of Control Wizard, which is used to delegate administrative authority, by providing the ability to revoke delegated administrative authority.”
#1 Best Overall
— Microsoft Download Center
Check the legacy platform requirements first
Microsoft lists version 1.0 of DSREVOKE.EXE and a publication date of July 15, 2024, alongside a 204.0 KB executable and 37.5 KB documentation file. These are download-page metadata, not evidence of recent maintenance or compatibility with modern Windows. The page names Windows 2000, Windows XP, and Windows Server 2003 as supported operating systems, and Windows 2000 and Windows Server 2003 Active Directory domain controllers as targets. Do not assume it is supported on a current client or server release.
Microsoft’s installation instructions say to run DSREVOKE /? from a command prompt on a Windows 2000, Windows XP, or Windows Server 2003 domain member or controller in the forest being targeted. Consult the documentation included with the utility for the exact syntax and prompt behavior before using it.
Report permissions before removing anything
- Identify the role and scope. Microsoft recommends using a unique security group for each specific administrative role and delegating through OU inheritance. Determine which group or user and which OU or OU scope you intend to review.
- Read the utility’s syntax. On a platform covered by Microsoft’s published instructions, open a command prompt on a domain member or controller in the target forest and run
DSREVOKE /?. Check the supplied documentation for the options and expected prompts. - Run a report. Use the report function to inspect the principal’s explicit permission entries on the relevant OU objects. A technical walkthrough gives this illustrative form:
Dsrevoke /Report OU=NewYork,DC=Contoso,DC=Com ContosoEd.Price
The domain and account are examples, not values to copy into a real environment. Confirm the distinguished name and principal format against the utility documentation and your directory. - Review the entries and intended scope. Do not treat a report as proof that every permission on every type of Active Directory object has been audited. Where needed, verify an entry in Active Directory Users and Computers (ADUC): enable View > Advanced Features, then inspect the OU’s Security tab and Advanced Security Settings. The walkthrough describes this check for a reported access control entry (ACE).
- Remove only after review. If the reported entries are the ones you intend to revoke, the walkthrough illustrates:
Dsrevoke /Remove OU=NewYork,DC=Contoso,DC=Com ContosoEd.Price
Confirm the exact principal and OU scope before proceeding. Use the installed utility’s documentation to verify the removal command’s syntax and prompt behavior; the example is not a guarantee of a preview or rollback mechanism.
For the Microsoft download and documentation, see the DSREVOKE.EXE Download Center page. The example commands and ADUC verification steps above are from a technical walkthrough, not evidence of a live test.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchKnown caveats and alternatives
Reported search and naming limitations
A 2019 secondary technical article reports that DSREVOKE may find only up to 1,000 OUs in one search and may fail when an OU name contains a forward slash. Microsoft’s download page does not itself document those limitations, so treat them as reported caveats rather than official specifications. If the search scope is large or names include a slash, validate coverage rather than assuming the report is complete. HeelpBook: Active Directory Delegated Permissions (View/Remove)
Considering dsacls.exe
The same article describes dsacls.exe as an option for removing delegated permissions, but says it does not search subcontainers in the way DSREVOKE does. The available descriptions do not establish it as a like-for-like reporting and traversal replacement. Compare the exact scope and entries each method affects before choosing one.
Do not confuse it with DFS Replication delegation
Microsoft’s Revoke-DfsrDelegation PowerShell cmdlet revokes permissions for users or groups on a DFS Replication group. That is a distinct, narrow DFSR operation, not a general replacement for removing OU permissions. Microsoft Learn: Revoke-DfsrDelegation
How to audit delegated permissions across Active Directory
For the question “How can I see what delegated permissions a user or group has across Active Directory?”, DSREVOKE’s documented role is narrower: report permissions for a specified principal on OUs. Start with the role group and OU scope you need to assess, run a report, and inspect relevant entries. Do not infer from a DSREVOKE report that all permissions throughout the directory—or permissions on non-OU objects—have been covered.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesBefore cleanup, distinguish the specific role-based entries you mean to revoke from other access that the principal may need. The documented report-then-review approach helps make the decision explicit; the sources do not establish a universal safe-removal preview or rollback workflow.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
