Hello,

Fairly new to scripting as I'm trying to achieve the following scenario via Powershell:

1) Create OU "TestOU" (done)

2) Create user "Testuser" and place user in existing security group "TestGroup" (done)

3) Take the security group "TestGroup" and add it to the created OU "TestOU". The only security rights i want "TestGroup" to have is the following:

Create Computer Objects

Delete Computer Objects 

Apply to: This object and all descendant objects.

I appreciate any help regarding step 3 :) 

Thank you.

• Edited by Mustafa-s Thursday, June 05, 2014 8:20 PM

Hello,

Fairly new to scripting as I'm trying to achieve the following scenario via Powershell:

1) Create OU "TestOU" (done)

2) Create user "Testuser" and place user in existing security group "TestGroup" (done)

3) Take the security group "TestGroup" and add it to the created OU "TestOU". The only security rights i want "TestGroup" to have is the following:

Create Computer Objects

Delete Computer Objects 

Apply to: This object and all descendant objects.

I appreciate any help regarding step 3 :) 

Thank you.

This is just a 10 second job in ADUC.  Are you trying to learn scripting in this area?  If so start by reading this command:  Dsacls

Cheers.

This should work for you, it worked for me.  I'm confident the ACE is correct:

cd AD:
$ou = "OU=TestOU,DC=domain,DC=local"
$group = "Domain\TestGroup"
$aceRights = [System.DirectoryServices.ActiveDirectoryRights]"CreateChild,DeleteChild"
$aceType =[System.Security.AccessControl.AccessControlType]::Allow
$aceID = New-Object System.Security.Principal.NTAccount($group)
[guid]$aceObj = "{BF967A86-0DE6-11D0-A285-00AA003049E2}"
$ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($aceID, $aceRights, $aceType, $aceObj, 1)
$acl = get-acl $ou
$acl.AddAccessRule($ace)
set-acl -aclobject $acl $ou

ActiveDirectoryRights : CreateChild, DeleteChild
InheritanceType       : All
ObjectType            : bf967a86-0de6-11d0-a285-00aa003049e2
InheritedObjectType   : 00000000-0000-0000-0000-000000000000
ObjectFlags           : ObjectAceTypePresent
AccessControlType     : Allow
IdentityReference     : Domain\Group
IsInherited           : False
InheritanceFlags      : ContainerInherit
PropagationFlags      : None

Edit: DSACLS would be better:

$ou = "ou=TestOU,dc=domain,dc=local"
$group = "domain\TestGroup"
dsacls `"$ou`" /G `"$group`":CCDC`;computer /I:T | out-null

I've got a module that I think can help you with this. If you have PSv3 or higher, look for the link to the 3.0 beta version of the module (v2 *might* work, but I've done zero testing since making major changes since version 2.1, and there are usually v3 or higher language changes that I accidentally use). Unfortunately, the documentation hasn't been updated since adding AD functionality, but I'll cover some examples below, and I'll be more than happy to answer any questions you may have. The documentation that's present can still help, it just won't reflect any of the new 3.0 changes (including AD support).

The module can be used as a replacement for the native Get-Acl and Set-Acl commands, or it can be used as a supplement. If you want to use it as a supplement, you can use Add-AccessControlEntry and/or Remove-AccessControl entry directly with the SD object returned from Get-Acl (via the pipeline). You can also just use New-AccessControlEntry and use the .Add*Rule() and .Remove*Rule() methods on the SD object returned from Get-Acl.

Here are some examples:

# Set up the OU and principal to start since we're going to use multiple commands to do
# the same thing:
$OU = "DC=TestGroup,DC=domain,DC=local"
$PrincipalToAdd = "TestGroup"

# Using native Get-Acl/Set-Acl; module as supplement
$SD = Get-Acl "AD:\$OU"
$SD | Add-AccessControlEntry -Principal $PrincipalToAdd -ActiveDirectoryRights CreateChild, DeleteChild -ObjectAceType computer
$SD | Get-AccessControlEntry -Principal $PrincipalToAdd  # To confirm it's in SD (which hasn't been saved)
$SD | Set-Acl  # Commit

# Using module to fully replace Get-Acl and Set-Acl:
# You could use Get-SecurityDescriptor and Set-SecurityDescriptor in place of Get-Acl and Set-Acl,
# but you can also just use Add-AccessControlEntry, and it will automatically get and set the SD:
Add-AccessControlEntry -Path $OU -Principal $PrincipalToAdd -ActiveDirectoryRights CreateChild, DeleteChild -ObjectAceType computer

# If you don't use -Force, you'll be prompted before making the change. I've got to tweak the confirmation prompt for AD objects
# since their SDs are HUGE, so you may have to just press Y or N (buttons might not be visible)

Notice that I just typed 'computer' for the ObjectAceType. If you're not sure what the property/propertyset/extended right/validated write/classobject name is that you're looking for, you can actually use wildcards there, and you should get a prompt if there's more than one object that meets the search criteria. You can also use Get-ADObjectAceGuid. See these examples (running from the ISE is recommended for Get-ADObjectAceGuid b/c of IntelliSense):

# Notice the prompt after submitting this command (PSv3 and higher uses Out-GridView)
New-AccessControlEntry -Principal $PrincipalToAdd -ActiveDirectoryRights CreateChild, DeleteChild -ObjectAceType *computer*

# Using Get-ADObjectGuid helper (type the last part out to see IntelliSense in action):
New-AccessControlEntry -Principal $PrincipalToAdd -ActiveDirectoryRights CreateChild, DeleteChild -ObjectAceType (Get-ADObjectAceGuid -ClassObject computer)

# More IntelliSense examples (type these commands instead of pasting them):
Get-ADObjectAceGuid -PropertySet "[name here]"
Get-ADObjectAceGuid -ValidatedWrite "[name here]"
Get-ADObjectAceGuid -ExtendedRight "[name here]"

# Another Get-ADObjectAceGuid example:
Get-ADObjectAceGuid *pass* -TypesToSearch ClassObject, ExtendedRight, PropertySet

And last, check out the Get-EffectiveAccess function:

# Adding wildcards so that more than just the computer object shows up:
$OU | Get-EffectiveAccess -Principal $PrincipalToAdd -ObjectAceTypes *Computer*
$OU | Get-EffectiveAccess -Principal $PrincipalToAdd -ObjectAceTypes *Computer* -ListAllRights

Again, if you have any questions or suggestions (or if you find any problems), please let me know.

Thanks Rhys, using DSACLS worked. Also suggested by AverageJoebyToronto.