Permit AD rights builtin groups

-

hello,

i've powershell scripts gives ad group rights ou. works fine exceprt builin groups. (like "windows authorization access group" group)

i'm using following script (this part of script, variables defined earlier in script):

when change "windows authorization access group" workes. how can work group?

### klantgroep read rechten geven op de ou van de klant
    $sec = $objdomaingroup.psbase.objectsecurity

    $act = [system.security.accesscontrol.accesscontroltype]::allow
    $objinherit = [system.directoryservices.activedirectorysecurityinheritance]"all"

    $adrights1 = [system.directoryservices.activedirectoryrights]::readcontrol
    $adrights2 = [system.directoryservices.activedirectoryrights]::listobject
    $adrights3 = [system.directoryservices.activedirectoryrights]::listchildren
    $adrights4 = [system.directoryservices.activedirectoryrights]::readproperty
 
### zet rechten bedrijfsgroep
    $who1 = new-object -typename system.security.principal.ntaccount -argumentlist "", "windows authorization access group"

    $newrule1 = new-object -typename system.directoryservices.activedirectoryaccessrule -argumentlist $who1, $adrights1, $act, $objinherit
    $newrule2 = new-object -typename system.directoryservices.activedirectoryaccessrule -argumentlist $who1, $adrights2, $act, $objinherit
    $newrule3 = new-object -typename system.directoryservices.activedirectoryaccessrule -argumentlist $who1, $adrights3, $act, $objinherit
    $newrule4 = new-object -typename system.directoryservices.activedirectoryaccessrule -argumentlist $who1, $adrights4, $act, $objinherit
   
    $sec.addaccessrule($newrule1)
    $sec.addaccessrule($newrule2)
    $sec.addaccessrule($newrule3)
    $sec.addaccessrule($newrule4)
   
    $objdomaingroup.psbase.commitchanges()

remco


what if use sid? http://support.microsoft.com/kb/243330

replace

$who1 = new-object -typename system.security.principal.ntaccount -argumentlist "", "windows authorization access group"

with

$who1 = new-object system.security.principal.securityidentifier("s-1-5-32-560")



Windows Server  >  Windows PowerShell



Comments

Post a Comment

Popular posts from this blog

directory stack

-
witchcraft>> $algo -eq $null true witchcraft>> cd $algo.key # directory stack: --- ---------------- 0 c:\users\voodoomsr\valhala 1 c:\users\voodoomsr\valhala\witchcraft\expectopatronum 2 c:\users\voodoomsr\valhala\witchcraft\expectopatronum\comunidad 3 c:\users\voodoomsr\valhala\witchcraft\expectopatronum\comunidad\stack 4 c:\users\voodoomsr\valhala -> 5 c:\users\voodoomsr\valhala\witchcraft witchcraft>> hi all, found extrange thing don't understand. if execute set-location inexistence object list of directories. what that? i see it, can't reproduce it.   when enter you've got posted there, set-location error, because value of argument "path" null.     [string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " " mistake!. after that, check alias cd , asigned function set-locationex. fu...
Read more

PowerShell List

-
hello everyone, i'm trying list vms in scvmm i'm using get-vm -vmmserver vmm01.mydomain.tld | export-csv c:\listvm.csv but returns info each vm, return properties want, way (that know) properties using: get-vm -vmmserver vmm01.mydomain.tld | format-list -property name, owner, description, operatingsystem, cpucount, memory, virtualizationplatform, hostname, status but if add get-vm -vmmserver vmm01.mydomain.tld | format-list -property name, owner, description, operatingsystem, cpucount, memory, virtualizationplatform, hostname, status | export-csv c:\listvm.csv now have mess... any way working nice , clean? thank you ok, found solution get-vm -vmmserver vmm01.mydomain.tld | select name, owner, description, operatingsystem, cpucount, memory, virtualizationplatform, hostname, status | export-csv c:\listvm.csv thank you. Windows Server  >  ...
Read more

Dns access list

-
hello i have situation following participants: mac osx server & windows 2003 dns server   problem: the mac osx server registering ip address in dns. i not want that. question: is there way control can register in windows dns? some sort of access list. know possible bind dns server regards k you have few options available in dns regarding dynamic updates.  can set zone's dynamic updates settings 1 of following: none, nonsecure , secure, , secure only. if set none, dynamic updates not allowed, nonsecure , secure allow clients update , secure only allow authenticated systems (members of domain example). if want control updates @ record level, can modify acl record once has been created.  zone can controlled via acl (properties, security tab). visit: anitkb.com , knowledge base. Windows Server  >  ...
Read more