title: Get-Acl from Different Domains
body: <p>Auditors are asking questions about ACL on certain groups in a couple of different domains.  I have put together a script that returns the information I need for our primary domain (Accounts) but can't seem to get it to switch to another domain (Medco) to get the ACL for those groups.  How do I switch the <code>Get-Acl</code> cmdlet to read the information from that other domain?</p>
  
  <pre><code>Get-Content 'U:\ad\scripts\Scripts - Input\ADGroup Permissions - Medco.txt' | ForEach-Object {
    $OutputG = $_
    $Group = "AD:" + (Get-ADgroup $_ -Server Medco).distinguishedname
    (Get-Acl $Group).access |
      Where-Object {
        $_.ActiveDirectoryRights -like "*write*" -or
        $_.ActiveDirectoryRights -like "*delete*"
      } |
      Sort-Object IdentityReference |
      Select-Object identityreference,
        @{L='Access'; E={$_.ActiveDirectoryRights -join ";"}},
        @{"n"="Group";"e"={"$OutputG"}}
  } | Export-csv ".\Scripts - Output\ACL_Medco_$CurrentDate.csv" -NoTypeInformation
  </code></pre>
  
  <p>The scenario is I'm reading group names from a .txt file for specific domains and then a <code>ForEach-Object</code> to pass the group name to get the <code>distinguishedName</code> to use it in the <code>Get-Acl</code>.  The first set of groups for the primary domain returns the information correctly (not showing that part).  I know the groups exist in the next domain but the problem is that the <code>Get-Acl</code> for it throws an error saying</p>
  
  <pre>Get-Acl : Cannot find path 'AD:CN=Medco Infrastructure & Security,OU=Recipients -
  Distribution Lists,OU=Legacy Exchange 5.5,OU=Exchange,DC=medco,DC=com' because it
  does not exist.
  At line:4 char:4
  +   (Get-Acl $Group).access
  +    ~~~~~~~~~~~~~~
      + CategoryInfo          : ObjectNotFound: (:) [Get-Acl], ItemNotFoundException
      + FullyQualifiedErrorId : GetAcl_PathNotFound_Exception, Microsoft.PowerShell.Commands.GetAclCommand</pre>