Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For distribution group, I can set parameter Manager can update membership list using the ADUC mmc, but I can't find how to do it using PowerShell. Moreover, even is Manager can update membership list property is set in ADUC, in PowerShell listing for Get-QADGroup ManagerCanUpdateMembershipList property is still set to false.

share|improve this question

In an AD 2003 environment, this is a 2-step process:

Add-QADPermission -Identity -Account -Rights WriteProperty -Property "Member" -ApplyTo 'ThisObjectOnly'

Set-QADGroup -ManagedBy

The first command will set the necessary permissions and is functional, but if there is not a user account already specified in the Managed By filed in ADUC, that field will remain empty and the box will not be checked. The second command populated this field, and when both conditions are met, the box will be checked.

Keep in mind that the ManagerCanUpdateMembershipList filed in the Group properties will still read FALSE in an AD environment without Active Roles Server. This field is apparently a proprietary field for Active Roles Server.

share|improve this answer

I have a blog post that explains how to do this with the ActiveDirectory module and ADSI, you can find it here, if you just want the code:

   Sets manager property on AD group and grants change membership rights.
   Sets manager property on AD group and grants change membership rights.
   This is done by manipulating properties directly on the DirectoryEntry object
   obtained with ADSI. This sets the managedBy property and adds an ACE to the DACL
   allowing said manager to modify group membership.
   Set-GroupManager -ManagerDN "CN=some manager,OU=All Users,DC=Initech,DC=com" -GroupDN "CN=TPS Reports Dir,OU=All Groups,DC=Initech,DC=com"
   (Get-AdGroup -Filter {Name -like "sharehost - *"}).DistinguishedName | % {Set-GroupManager "CN=some manager,OU=All Users,DC=Initech,DC=com" $_}
function Set-GroupManager {
    param (
        [Parameter(Mandatory=$true, ValueFromPipeline=$false, ValueFromPipelinebyPropertyName=$True, Position=0)]
        [Parameter(Mandatory=$true, ValueFromPipeline=$false, ValueFromPipelinebyPropertyName=$True, Position=1)]

    try {
        Import-Module ActiveDirectory -NoClobber

        $mgr = [ADSI]"LDAP://$ManagerDN";
        $identityRef = (Get-ADUser -Filter {DistinguishedName -like $ManagerDN}).SID.Value
        $sid = New-Object System.Security.Principal.SecurityIdentifier ($identityRef);

        $adRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($sid, `
                    [System.DirectoryServices.ActiveDirectoryRights]::WriteProperty, `
                    [System.Security.AccessControl.AccessControlType]::Allow, `

        $grp = [ADSI]"LDAP://$GroupDN";

        $grp.InvokeSet("managedBy", @("$ManagerDN"));

        # Taken from here:
        [System.DirectoryServices.DirectoryEntryConfiguration]$SecOptions = $grp.get_Options();
        $SecOptions.SecurityMasks = [System.DirectoryServices.SecurityMasks]'Dacl'

    catch {

it can be found here

share|improve this answer

Your question intrigued me and I've used google to find an answer... I have no experience with Quest cmdlets for PoSh.

Description for New-QADGroup says that using ManagerCanUpdateMembershipList parameter requires connection to ActiveRoles Server

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.