**Best article**  
[AdminSDHolder, Protected Groups and Security Descriptor Propagator - TechNet Articles - United States (English) - TechNet Wiki (microsoft.com)](https://social.technet.microsoft.com/wiki/contents/articles/22331.adminsdholder-protected-groups-and-security-descriptor-propagator.aspx)
   

**Get a list of users tagged**  
get-aduser -Filter {admincount -gt 0} -Properties adminCount | select Name,DistinguishedName,Enabled,SamAccountName,adminCount | Export-Csv c:\temp\adminsdholder.csv -NoTypeInformation
   

**Get a list of groups with this designation**  
Get-ADGroup –LDAPFilter “(admincount=1)” -Properties description | Export-Csv c:\temp\adminSDholderGROUPS.csv -NoTypeInformation