0

. The only problem is that the rights are not propagating to the extended attribute, even in the advanced tab :(.

If I go in to adsi and check the security tab of the extended right it shows nothing regarding the new group having rights... but ... If I check the variable $rootObjACL.access, it shows the rights as they should be.

ActiveDirectoryRights : ExtendedRight
InheritanceType       : None
ObjectType            : 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
InheritedObjectType   : 00000000-0000-0000-0000-000000000000
ObjectFlags           : ObjectAceTypePresent
AccessControlType     : Allow
IdentityReference     : NEW\Replication
IsInherited           : False
InheritanceFlags      : None
PropagationFlags      : None**  

Trying to figure out what I am doing wrong. There are no errors what so ever while running the script. Here is the script below.

Import-Module ActiveDirectory

$rootObjPath = "AD:\CN=Configuration,DC=new,DC=domain,DC=com"

$rootObjACL = Get-Acl $rootObjPath

$group = Get-ADgroup 'Replication'

$SID = New-Object System.Security.Principal.SecurityIdentifierArgumentList $group.SID

# The following object specific ACE is to grant Group the permission     DS-Replication-Get-Changes

$objectGuid = New-Object Guid 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2

$ADRight = [System.DirectoryServices.ActiveDirectoryRights]"ExtendedRight"

$ACEType = [System.Security.AccessControl.AccessControlType]"Allow"

$ACE = New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $SID,$ADRight,$ACEType,$objectGuid

$rootObjACL.AddAccessRule($ACE)



Set-Acl $rootObjPath -AclObject $rootObjACL
7
  • You need to add more details
    – Jim B
    Apr 16, 2015 at 15:13
  • @JimB I added additional info in the top message.
    – NobleMan
    Apr 16, 2015 at 15:34
  • I think this has the makings to be a good question. Instead of referencing back to something else include what you're trying to accomplish and what you're starting with.
    – Scott Pack
    Apr 17, 2015 at 3:02
  • @ScottPack agreed - sticking in a link doesn't cut it, so it should be closed
    – Jim B
    Apr 17, 2015 at 17:01
  • @JimB As it stands, yes, but I see some potential here so I wanted to give it a chance to get awesome first.
    – Scott Pack
    Apr 17, 2015 at 17:43

0

You must log in to answer this question.

Browse other questions tagged .