How to set or clear “Manager can update membership list” using PowerShell

Question

For distribution group, I can set parameter Manager can update membership list using the ADUC mmc, but I can't find how to do it using PowerShell. Moreover, even is Manager can update membership list property is set in ADUC, in PowerShell listing for Get-QADGroup ManagerCanUpdateMembershipList property is still set to false.

Answer 1

In an AD 2003 environment, this is a 2-step process:

Add-QADPermission -Identity -Account -Rights WriteProperty -Property "Member" -ApplyTo 'ThisObjectOnly'

Set-QADGroup -ManagedBy

The first command will set the necessary permissions and is functional, but if there is not a user account already specified in the Managed By filed in ADUC, that field will remain empty and the box will not be checked. The second command populated this field, and when both conditions are met, the box will be checked.

Keep in mind that the ManagerCanUpdateMembershipList filed in the Group properties will still read FALSE in an AD environment without Active Roles Server. This field is apparently a proprietary field for Active Roles Server.

Answer 2

Your question intrigued me and I've used google to find an answer... I have no experience with Quest cmdlets for PoSh.

Description for New-QADGroup says that using ManagerCanUpdateMembershipList parameter requires connection to ActiveRoles Server

• http://wiki.powergui.org/index.php/New-QADGroup
• http://www.quest.com/activeroles-server/