Powershell script to set AD permissions fails with "Access Denied" despite running account having the correct permissions

Question

I'm using the following Powershell cmdlet as part of a script:

# Posted by TobyU at www.pwsh.ch on 13.09.2018
# https://www.pwsh.ch/active-directory-powershell-delegate-permission-to-reset-user-passwords-for-a-specific-organizational-unit-150.html

function Set-ResetPasswordDelegation(){
    param(
    [string]$OrganizationalUnit,
    [string]$DelegationGroupName
    )

    # Configuration Parameters
    $confADRight = "ExtendedRight"
    $confDelegatedObjectType = "bf967aba-0de6-11d0-a285-00aa003049e2" # User Object Type GUID
    $confExtendedRight = "00299570-246d-11d0-a768-00aa006e0529" # Extended Right PasswordReset GUID

    # Collect and prepare Objects
    $delegationGroup = Get-ADGroup -Identity $DelegationGroupName
    $delegationGroupSID = [System.Security.Principal.SecurityIdentifier] $delegationGroup.SID
    $delegationGroupACL = Get-Acl -Path "AD:\$OrganizationalUnit"

    # Build Access Control Entry (ACE)
    $aceIdentity = [System.Security.Principal.IdentityReference] $delegationGroupSID
    $aceADRight = [System.DirectoryServices.ActiveDirectoryRights] $confADRight
    $aceType = [System.Security.AccessControl.AccessControlType] "Allow"
    $aceInheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] "Descendents"
    $ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($aceIdentity, $aceADRight, $aceType, $confExtendedRight, $aceInheritanceType,$confDelegatedObjectType)

    # Apply ACL
    $delegationGroupACL.AddAccessRule($ace)
    Set-Acl -Path "AD:\$OrganizationalUnit" -AclObject $delegationGroupACL
}

To summarize, the script above is intended to delegate password reset permissions, so that a certain security group (DelegationGroupName parameter) is allowed to reset passwords for all users inside a certain OU (OrganisationalUnit parameter).

This works fine when run as an administrator, but when I try to run it as an account that I use to run scheduled tasks, I run into a problem. See below:

PS D:\Program\ocpermissions> Set-ResetPasswordDelegation -OrganizationalUnit 'OU=Test,OU=ITA,DC=kos,DC=local' 'Test PW Reset Group'
Set-Acl : This security ID may not be assigned as the owner of this object
At D:\Program\ocpermissions\PasswordResetDelegation.psm1:29 char:5
+     Set-Acl -Path "AD:\$OrganizationalUnit" -AclObject $delegationGro ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (OU=Test,OU=ITA,DC=kos,DC=local:St
   ring) [Set-Acl], ADException
    + FullyQualifiedErrorId : ADProvider:SetSecurityDescriptor:ADError,Microso
   ft.PowerShell.Commands.SetAclCommand

This is despite the fact that I have given the user that the script is running to full control to the OU and all objects in it. (Just for testing purposes.) I also can't see that the code is trying to change the owner of the OU either, so that confuses me even more.

Strangely, I don't even get the same thing in my actual production OU when testing this, Instead I get this:

Set-Acl : Access is denied
At D:\Program\ocpermissions\PasswordResetDelegation.psm1:29 char:5
+     Set-Acl -Path "AD:\$OrganizationalUnit" -AclObject $delegationGro ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (OU=Externa anvä...DC=kos,DC=l
   ocal:String) [Set-Acl], UnauthorizedAccessException
    + FullyQualifiedErrorId : ADProvider:SetSecurityDescriptor:AccessDenied,Mi
   crosoft.PowerShell.Commands.SetAclCommand

What could be going on? What could be stopping the script from working correctly? (I should add that the script works fine with an account having Domain Admin privileges, but I really don't want to run a scheduled task with under those permissions.)

Answer 1

It seems that Set-Acl doesn't work correctly in this context. Not sure exactly what was wrong with it, but when instead using Set-ADOrganizationalUnit $ou -Replace @{nTSecurityDescriptor = $ouacl} to set the ACL, the problem disappeared.

That tells me the problem wasn't with AD permissions as I originally suspected.

Here's the fixed version of the function I was trying to use:

function Set-ResetPasswordDelegation(){
    param(
    [string]$OrganizationalUnit,
    [string]$DelegationGroupName
    )

    # Configuration Parameters
    $confADRight = "ExtendedRight"
    $confDelegatedObjectType = "bf967aba-0de6-11d0-a285-00aa003049e2" # User Object Type GUID
    $confExtendedRight = "00299570-246d-11d0-a768-00aa006e0529" # Extended Right PasswordReset GUID

    # Collect and prepare Objects
    $delegationGroup = Get-ADGroup -Identity $DelegationGroupName
    $delegationGroupSID = [System.Security.Principal.SecurityIdentifier] $delegationGroup.SID
    $ou = Get-ADOrganizationalUnit -Properties nTSecurityDescriptor $OrganizationalUnit
    $ouacl = $OU.nTSecurityDescriptor

    # Build Access Control Entry (ACE)
    $aceIdentity = [System.Security.Principal.IdentityReference] $delegationGroupSID
    $aceADRight = [System.DirectoryServices.ActiveDirectoryRights] $confADRight
    $aceType = [System.Security.AccessControl.AccessControlType] "Allow"
    $aceInheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] "Descendents"
    $ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($aceIdentity, $aceADRight, $aceType, $confExtendedRight, $aceInheritanceType,$confDelegatedObjectType)

    # Apply ACL
    $ouacl.AddAccessRule($ace)
    Set-ADOrganizationalUnit $ou -Replace @{nTSecurityDescriptor = $ouacl}
}