1

I need to build a script which check if the current user has rights to delete a special AD object and if this is the case the powershell script can delete it.

Deleting an AD object isn´t the issue, the question I have is more how to check if the current user (which runs the script) has the right to do so? Use a try/catch seamed not the best way I think.

Any good idea?

1

1 Answer 1

1

That thread Tim linked has good info, here is a native way:

(Get-Acl -Path "AD:\CN=John Doe,OU=Users,DC=contoso,DC=com" | `
select -ExpandProperty Access) | `
select ActiveDirectoryRights,IdentityReference

With that, you should be able to get that into an Object and compare the user you're working as with -contains.

Here are a couple blogs from Microsoft MVPs on this:

Ashley McGlone

Hey, Scripting Guy

2
  • Yes I found that snipplet already. But its not working, if you will try to use -contains it means you NEED be directly added to that object. If you use AD groups, which is the case in most AD environments it will never work as you need to go true all groups at first. So this isn´t really the solution.
    – BastianW
    Apr 24, 2015 at 18:05
  • This will give you all the ACEs for a given object. Just because it isn't easy to implement doesn't mean it doesn't work. What you say is correct, but I didn't post this for it to be the total solution, just a method to use in a script. You would have to get the $admin.MemberOf attribute, and compare it to the ACEs, and then make sure it had a property that included the rights to delete. You'd probably also need a recursive function to get any nested ADGroupMembership for the user.
    – mortenya
    Apr 24, 2015 at 19:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .