1

I’m attempting to automate delegated permissions of an Active Directory (AD) Organizational Unit (OU) using Access Control Entries (ACE).

However, I don’t fully understand Active Directory schema and I’m facing an issue where my PowerShell results do not match the manually configured OU permissions as set via dsa.msc (Active Directory Users and Computers).

There is one setting that the UI sets, InheritedObjectType bf967a86-0de6-11d0-a285-00aa003049e2 which corresponds to “Application-Version” that I can’t get to set via PowerShell or dsacls.exe

Does anyone know why the UI when I set the settings I receive this extra ActiveDirectoryRight CreateChild on Application-Version InheritedObjectType and how I would replicate that setting via powershell?

I’m using win_ad_dacls.ps1 by Jordan Borean so as to not reinvent the wheel (and so I can run this idempotently and natively via ansible).

End Goal

Give rights to a User/Group on all Computer Objects of all Children of an OU to the following:

  • Read
  • Write
  • Create All Child Objects
  • Read All Properties
  • Write All Properties
  • Reset Password

Testing/Validation Method

Get-Acl 'AD:\OU=TestOU,OU=Servers,OU=TestADACE,DC=domain,DC=local' | Select-Object -ExpandProperty Access | Where-Object {$_.IdentityReference -match 'domain\\testuser'}

UI Settings That Actually Get Set

These are the settings I see when I run the PowerShell above in Testing/Validation Method after setting the 6 permissions under the End Goal section of this document in Active Directory Users and Computers (dsa.msc) using the Delegation Wizard on Computer Objects.

ActiveDirectoryRights : CreateChild, ListChildren, ReadProperty, GenericWrite
InheritanceType       : Descendents
ObjectType            : 00000000-0000-0000-0000-000000000000
InheritedObjectType   : bf967a86-0de6-11d0-a285-00aa003049e2
ObjectFlags           : InheritedObjectAceTypePresent
AccessControlType     : Allow
IdentityReference     : domain\testuser
IsInherited           : False
InheritanceFlags      : ContainerInherit
PropagationFlags      : InheritOnly

ActiveDirectoryRights : CreateChild
InheritanceType       : Descendents
ObjectType            : ddc790ac-af4d-442a-8f0f-a1d4caa7dd92
InheritedObjectType   : bf967a86-0de6-11d0-a285-00aa003049e2
ObjectFlags           : ObjectAceTypePresent, InheritedObjectAceTypePresent
AccessControlType     : Allow
IdentityReference     : domain\testuser
IsInherited           : False
InheritanceFlags      : ContainerInherit
PropagationFlags      : InheritOnly

ActiveDirectoryRights : ExtendedRight
InheritanceType       : Descendents
ObjectType            : 00299570-246d-11d0-a768-00aa006e0529
InheritedObjectType   : bf967a86-0de6-11d0-a285-00aa003049e2
ObjectFlags           : ObjectAceTypePresent, InheritedObjectAceTypePresent
AccessControlType     : Allow
IdentityReference     : domain\testuser
IsInherited           : False
InheritanceFlags      : ContainerInherit
PropagationFlags      : InheritOnly

Item That I Can’t Figure Out

Of the settings set via UI (dsa.msc), this is the one I can’t figure out how to automate. My concern is that skipping this setting will break something.

ActiveDirectoryRights : CreateChild
InheritanceType       : Descendents
ObjectType            : ddc790ac-af4d-442a-8f0f-a1d4caa7dd92
InheritedObjectType   : bf967a86-0de6-11d0-a285-00aa003049e2
ObjectFlags           : ObjectAceTypePresent, InheritedObjectAceTypePresent
AccessControlType     : Allow
IdentityReference     : domain\testuser
IsInherited           : False
InheritanceFlags      : ContainerInherit
PropagationFlags      : InheritOnly

Powershell Settings That I Can Set Using The Ansible Playbook Below and This Ansible Module

These are the settings I see when I run the PowerShell above in Testing/Validation Method after setting the permissions listed under Ansible Tasks below.

ActiveDirectoryRights : CreateChild, ListChildren, ReadProperty, GenericWrite
InheritanceType       : Descendents
ObjectType            : 00000000-0000-0000-0000-000000000000
InheritedObjectType   : bf967a86-0de6-11d0-a285-00aa003049e2
ObjectFlags           : InheritedObjectAceTypePresent
AccessControlType     : Allow
IdentityReference     : domain\testuser
IsInherited           : False
InheritanceFlags      : ContainerInherit
PropagationFlags      : InheritOnly

ActiveDirectoryRights : ExtendedRight
InheritanceType       : Descendents
ObjectType            : 00299570-246d-11d0-a768-00aa006e0529
InheritedObjectType   : bf967a86-0de6-11d0-a285-00aa003049e2
ObjectFlags           : ObjectAceTypePresent, InheritedObjectAceTypePresent
AccessControlType     : Allow
IdentityReference     : domain\testuser
IsInherited           : False
InheritanceFlags      : ContainerInherit
PropagationFlags      : InheritOnly

Ansible Tasks

  - name: Broad access on Computer Objects in App OU
    state: present
    path: "OU=TestOU,OU=Servers,OU=TestADACE,DC=domain,DC=local"
    rights: CreateChild, ListChildren, ReadProperty, GenericWrite
    inheritance_type: Descendents
    inherited_object_type: Computer
    object_type: 00000000-0000-0000-0000-000000000000
    access: allow
    account: domain\testuser
    
  - name: Reset Password Permission on Computer Objects in App OU
    state: present
    path: "OU=TestOU,OU=Servers,OU=TestADACE,DC=domain,DC=local"
    rights: ExtendedRight
    inheritance_type: Descendents
    inherited_object_type: Computer
    object_type: 00299570-246d-11d0-a768-00aa006e0529 # the rightsGuid for the extended right User-Force-Change-Password (“Reset Password”) class
    access: allow
    account: domain\testuser

0

You must log in to answer this question.

Browse other questions tagged .