Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I needed to create a large number of Domain Local security groups in AD, so wanted to script it with PoSH rather than manually create each one.

I am getting an Access Denied error if I try to create the groups in PoSH, but can create them in ADUC with no problem. Same thing happens when trying to add members.

What could the issue be? I've checked the event log, but all I get is Access Denied from DS events (4662), with no additional information.

I've tried it on multiple DCs, using the Powershell Modules for Active Directory shortcut, as well as a regular Powershell session using Import-Module Active-Directory.

EDIT: Below is an example error:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          28/06/2011 11:57:54 AM
Event ID:      4662
Task Category: Directory Service Access
Level:         Information
Keywords:      Audit Failure
User:          N/A
An operation was performed on an object.

Subject :
    Security ID:        mydomain\user
    Account Name:       user
    Account Domain:     mydomain
    Logon ID:       0x8d81c809

    Object Server:      DS
    Object Type:        group
    Object Name:        CN=SERVERNAME-RDP-Users,OU=SQL Servers,OU=RDP,OU=Server Login Permissions,DC=mydomain,DC=com
    Handle ID:      0x0

    Operation Type:     Object Access
    Accesses:       Write Property

    Access Mask:        0x20
    Properties:     ---

Additional Information:
    Parameter 1:        -
    Parameter 2:        
Event Xml:
<Event xmlns="">
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <TimeCreated SystemTime="2011-06-28T01:57:54.401588800Z" />
    <Correlation />
    <Execution ProcessID="520" ThreadID="684" />
    <Security />
    <Data Name="SubjectUserSid">S-1-5-21-1580943700-3625058406-2646640161-1105</Data>
    <Data Name="SubjectUserName">User</Data>
    <Data Name="SubjectDomainName">mydomain</Data>
    <Data Name="SubjectLogonId">0x8d81c809</Data>
    <Data Name="ObjectServer">DS</Data>
    <Data Name="ObjectType">%{bf967a9c-0de6-11d0-a285-00aa003049e2}</Data>
    <Data Name="ObjectName">%{29c4e057-b8d3-4fa2-9f91-8dd6336897b4}</Data>
    <Data Name="OperationType">Object Access</Data>
    <Data Name="HandleId">0x0</Data>
    <Data Name="AccessList">%%7685
    <Data Name="AccessMask">0x20</Data>
    <Data Name="Properties">---
    <Data Name="AdditionalInfo">-</Data>
    <Data Name="AdditionalInfo2">
share|improve this question
when you look at the security logs on a dc while running the script what errors do you see – tony roth Jun 28 '11 at 1:56
Thanks Tony, I'm updating the question to include an example error. – Matt Jun 28 '11 at 1:59
Running from a Vista/Win7/Server2008+ computer with an non-elevated prompt? – Chris S Jun 28 '11 at 2:10
can you emulate the issue with a dsquery\dset command? – tony roth Jun 28 '11 at 3:06
can you paste the ps code. I use powershell quite a lot but I usually will use the ds* commands before moving to powershell. – tony roth Jun 28 '11 at 3:13
up vote 2 down vote accepted

Ok found the answer. There's a security feature in Win2K8 that prevents you from running these cmdlets locally on a DC. So basically you need to either run them from a workstation using PSRemoting, or just specify another DC using the -Server switch.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.