I want to create a group in AD that has the permission to create group objects and edit group objects in a specific Organization Unit.

Question

I want to create a group in AD that has the permission to create group objects and edit group objects in a specific Organizational Unit.

I made a script that is able to do this. I created a group that can create object and edit them, but it isn't restricted to Group objects only. How can I add this feature?

I was able to do that with the dsa for testing, but I need to do it using a script.

ps1 script:

$OrganizationalUnit = "OU=TargetOUGroups, (...)"

$GroupName = "GroupManager"

if (-not (Get-ADGroup -Filter {Name -eq $GroupName})) {

    New-ADGroup -Name $GroupName -GroupCategory Security -GroupScope Global -Path $OrganizationalUnit

}

Set-Location AD:

$Group = Get-ADGroup -Identity $GroupName

$GroupSID = $Group.SID

$ACL = Get-Acl -Path "AD:$OrganizationalUnit"

$Identity = New-Object System.Security.Principal.SecurityIdentifier($GroupSID)

$ADRights = @("WriteProperty", "CreateChild")

$Type = [System.Security.AccessControl.AccessControlType]::Allow

$InheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance]::All

foreach ($ADRight in $ADRights) {

    $ADRightType = [System.DirectoryServices.ActiveDirectoryRights]$ADRight

    $Rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($Identity, $ADRightType, $Type, $InheritanceType)

    $ACL.AddAccessRule($Rule)

}

Set-Acl -Path "AD:$OrganizationalUnit" -AclObject $ACL

Answer 1

The list of all the AD classes can be found over here

All Classes - Win32 apps | Microsoft Learn

Answer 2

Hi iggodinho,

You can specify the object type to which the access rule applies.

$objectType =[guid]"bf967a9c-0de6-11d0-a285-00aa003049e2" 

$Rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($Identity, $ADRightType, $Type, $objectType, $InheritanceType)

bf967a9c-0de6-11d0-a285-00aa003049e2 is the schema GUID of the group object.

Best Regards,

Ian Xue

Answer 3

Thank you very much for the help.

It worked.

I would like to do this for other objects. Where can I get the schema GUID for other object types? Such as user or OU