Get current SDDL from AD Administrator

Get-Acl has an Sddl property on the output and you can use it against AD objects like this:

$dn = (Get-ADUser administrator).distinguishedName
(Get-Acl "AD:$dn").Sddl

From there you could convert it with ConvertFrom-SddlString as well. But were I in your shoes, I'd just compare the raw Sddl strings first and only bother converting if they're different (assuming you know your backup value is "good").

Thanks for the hint Ryan!

Based on this I was able to compare the objects with something like:

$oldSddl = "backupSDDLStringHere"
$oldSddlObject = ConvertFrom-SddlString -Type ActiveDirectoryRights $oldSddl
$dn = (Get-ADUser administrator).distinguishedName
$newSddl = (Get-Acl "AD:$dn").Sddl
$newSddlObject = ConvertFrom-SddlString -Type ActiveDirectoryRights $newSddl
Compare-Object -ReferenceObject $oldSddlObject.DiscretionaryAcl -DifferenceObject $newSddlObject.DiscretionaryAcl

That seems to work and shows me the difference. And Ryan yes, the Sddl is different but it might be caused by the CU update.