0

I'm trying to standardise our AD permissions for our 4 support groups. I've already applied permissions for 2 standard groups (Global support) and I'm now facing a painful clean-up for site based support for which there's a specific group to assign permissions to. Obviously, if I can find an answer to this, I can look at implementing the permissions to the global groups as well for new OUs. By permissions I mean delegation.

To speed up things, I already have certain OUs already set correctly, so what I've been doing is copying permissions and apply them to another OU. This is the structure of AD: -Site 1 --Desktops --Laptops --Users -Site 2 --Desktops --Users

And so on. Now, let's say I have Site 1 correctly configured (please note that I'm assigning permissions at each sub-OU, so Desktops, Laptops and so on). I would do the following for each group:

Get-QADPermission "OU=Users,OU=Site1,DC=contoso,DC=com" -Account "CONTOSO\_HelpDesk" | Add-QADPermission "OU=Users,OU=Site2,DC=contoso,DC=com"

Now, coming to the question: How can I export those permissions for _HelpDesk in a file and re-import them in a later stage on a different group? For instance, I want to export the permissions for _HelpDesk, save them to a file called _HelpDesk_delegation.txt (or whatever extension) and then, a week later, I want to import them in a variable and apply them to another OU for another Group, for instance OU=Users,OU=Site5,DC=contoso,DC=com and for _Site5-Local-IT group?

A bit hard to explain but the concept is there.

Bear in mind that right now I'm not able to even "live"copy the permissions for HelpDesk and assign them to _Site5-Local-IT with the above command. Hopefully you can guide me through this little issue. One thing I've noticed is that Quest is way better in copy/apply permissions than the built-in AD module.

Thanks

Improve this question
2
  • Have you researched Get-Acl and Set-Acl?
    – Colyn1337
    Apr 22, 2015 at 21:11
  • I did. Problem is, they are also too complicated. I think there should be an easier way to just export all of the variable to a file, all of its content. It doesn't!
    – Something
    Apr 23, 2015 at 5:47

1 Answer 1

Reset to default
-1

There are scripts here to export and import: https://www.akaplan.com/blog/2017/08/export-and-import-delegated-ou-permissions-with-powershell/

Improve this answer
1
  • 1
    Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – Jenny D
    Aug 18, 2017 at 19:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .