Quantcast
Channel: Windows PowerShell forum
Viewing all articles
Browse latest Browse all 21975

AD delegation rule not applying

$
0
0

I am designing a Powershell GUI to set AD delegations on various OUs. For the most part it works but I found when trying to remove an ACL on modifying users objects the permission would not be removed (see else statement):

function set-Users-ModifyFullAccess ($s, $acl, $oupath, $act)
{
 # userAccountControl - bf967a68-0de6-11d0-a285-00aa003049e2
 # ObjectType: bf967aba-0de6-11d0-a285-00aa003049e2
 # InheritedObjectType: 00000000-0000-0000-0000-000000000000

 if ($act -eq "add")
 {
  $acl.AddAccessRule((New-Object
System.DirectoryServices.ActiveDirectoryAccessRule
$s,"GenericAll","Allow",([GUID]("00000000-0000-0000-0000-000000000000")).guid,"Descendents",([GUID]("bf967aba-0de6-11d0-a285-00aa003049e2")).guid))

 }
 else
 {
  $acl.RemoveAccessRule((New-Object
System.DirectoryServices.ActiveDirectoryAccessRule
$s,"GenericAll","Allow",([GUID]("00000000-0000-0000-0000-000000000000")).guid,"Descendents",([GUID]("bf967aba-0de6-11d0-a285-00aa003049e2")).guid))

 }

}

The permission looks like so:

ActiveDirectoryRights : GenericAll
InheritanceType       : Descendents
ObjectType            : 00000000-0000-0000-0000-000000000000
InheritedObjectType   : bf967aba-0de6-11d0-a285-00aa003049e2
ObjectFlags           : InheritedObjectAceTypePresent
AccessControlType     : Allow
IdentityReference     : domain\Helpdesk
IsInherited           : False
InheritanceFlags      : ContainerInherit
PropagationFlags      : InheritOnly

I think the issue might be related to ObjectFlags being set to InheritedObjectAceTypePresent as this is the only thing different from other permissions that do get removed successfully.

Note: wasn't sure if I should post in 'Domain Services' or 'Powershell' forum so apologies if I posted in the wrong place.



Viewing all articles
Browse latest Browse all 21975

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>