-Author $ShirleyM

Manager can update membership list Part 3

shirl9141 — Thu, 24 Oct 2013 15:44:00 GMT

In the first post, we looked at the script to allow a manager of an AD group to update the membership list. The second post demonstrated how to retrieve the guid for the extended rights to apply this right. Now we will look at how to determine what rights are needed for updating a membership list in an AD group.

The script below is setting up the AD group for specific rights.

$ctrl=[System.Security.AccessControl.AccessControlType]::Allow

$rights=[System.DirectoryServices.ActiveDirectoryRights]::WriteProperty -bor[System.DirectoryServices.ActiveDirectoryRights]::ExtendedRight

$intype=[System.DirectoryServices.ActiveDirectorySecurityInheritance]::None

Of course, we can go through documentation to determine the rights, but who has time to go through documentation. Why don't we just give the user permissions to manage the list, then look at the rights given? Then take away those rights by clearing the permissions manually through the gui.

Toggle these permissions, then look at the difference by executing the following command.

Now we are able to determine what flags and rights to set for the AD group object. Next we need to add this AD rule to the current ACL. Create the new rule by using the .NET class, System.DirectoryServices.ActiveDirectoryAccessRule. Look at the constructor on MSDN to determine what parameters are required.

Create the new access rule, add the new rule, and then set the acl with the new rule.

$acl=Get-Acl ad:"cn=testgroup,cn=users,dc=contoso,dc=com"

$rule=New-ObjectSystem.DirectoryServices.ActiveDirectoryAccessRule($sid,$rights,$ctrl,$guid)

$acl.AddAccessRule($rule)

Set-Acl $acl -path ad:"cn=testgroup,cn=users,dc=contoso,dc=com"

Voila! We have checked the checkbox. The manager of the group now has permission to update the membership list.

Manager can update membership list Part 2

shirl9141 — Wed, 23 Oct 2013 18:30:00 GMT

There are 3 posts to this topic. This post demonstrates how
to find the guid for the script, which permits a user to manage a group’s
membership list. The goal is to automate
the task of giving a user permissions to manage a group without having admin
rights. The manager of the list can remove/add users without being a domain
admin.

First we need to find the guid that will give the manager of
the group these extend rights. Once, we have this guid, then we can apply this
guid to the AD group.

What is the guid and how do we find this guid?

We need to find the Global Unique Identifier for
the Self Membership extended right.

Open ADSI Edit

Right-Click ADSI Edit and select Connect To

Connect to Configuration

Select CN=Configuration and then CN=Extended-Rights

Open CN=Self-Membership

Find the guid under rightsGuid

Now we can apply this guid to the AD Access Rule on the AD
object, which will be explained in the next post. In the next post we will look at the rights and how to determine the rights.

Manager can update membership list Part 1

shirl9141 — Mon, 07 Oct 2013 20:23:00 GMT

Sometimes trying to automate something simple as selecting a checkbox is no simple task. This is the first part of a series of posts on how to select the 'Manager can update membership list' checkbox for an AD group in PowerShell. The first part will give you the PowerShell script that will automate this process. The continuation of this post will go over the script in more detail and show you the steps that led up to this solution.

Below is the GUI used to select the user to manage the group and whether that user is allowed to update the membership list. Setting the manger is the easy part, but selecting the checkbox can be a little more complicated.

The script below will set the user as the manager and allow them to update the membership list. There will be more to come in the next posts to look at the script in fine detail.

look at adsi-edit for this guid

Configuration -> Extended Rights -> Self-Membership

Open Self-Membership and the guid will be under rightsGuid

$guid =[guid]'bf9679c0-0de6-11d0-a285-00aa003049e2'

$user = New-Object System.Security.Principal.NTAccount("contoso\jsmith")

$sid =$user.translate([System.Security.Principal.SecurityIdentifier])

$acl = Get-Acl ad:"cn=testgroup,cn=users,dc=contoso,dc=com"

$ctrl =[System.Security.AccessControl.AccessControlType]::Allow

$rights =[System.DirectoryServices.ActiveDirectoryRights]::WriteProperty -bor[System.DirectoryServices.ActiveDirectoryRights]::ExtendedRight

$intype =[System.DirectoryServices.ActiveDirectorySecurityInheritance]::None

#set the ManagedBy property

$group =[adsi]'LDAP://cn=testgroup,cn=users,dc=contoso,dc=com'

$group.put("ManagedBy","CN=jillsmith,OU=TestOU,DC=Contoso,DC=COM")

$group.setinfo()

#create the new rule and add the rule
# https://msdn.microsoft.com/en-us/library/xh02bekw.aspx

$rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($sid,$rights,$ctrl,$guid)

$acl.AddAccessRule($rule)

Set-Acl -acl $acl -path ad:"cn=testgroup,cn=users,dc=contoso,dc=com"

Write-Host "Voila! We have the checkbox checked"

The next post will explain how to obtain the guid for the Self Member extended right.

Part 2