I have an OU in AD called SQL. I have delegated full control of the OU to a user called sqladmin.
If I log in to a member server as sqladmin, I can use Active Directory Users and Computers to create two different computer objects, AG and Cluster. I can use ADUC to to set the security on AG computer object such that the Cluster computer object has full control.
However, if I try to do this with PowerShell by getting the current ACL off of AG and adding an ACE, I get an Access Denied error when I try to set the ACL on the AG Computer object.
Here is my code
$AG = Get-ADComputer AG $cluster = Get-ADComputer cluster $AGDistinguishedName = $AG.DistinguishedName # input AD computer distinguishedname $AGacl = Get-Acl "AD:\$AGDistinguishedName" $SID = [System.Security.Principal.SecurityIdentifier] $cluster.SID $identity = [System.Security.Principal.IdentityReference] $SID $adRights = [System.DirectoryServices.ActiveDirectoryRights] "GenericAll" $type = [System.Security.AccessControl.AccessControlType] "Allow" $inheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] "None" $ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $identity,$adRights,$type,$inheritanceType $AGacl.AddAccessRule($ace) Set-Acl -path "AD:\$AGDistinguishedName" -AclObject $AGacl
However, If I log in as a domain admin and run the code, it works fine. The code only fails when I log in as the sqladmin user. However, I can perform the task with sqladmin using the GUI.
I can also confirm that if I use the GUI, the ACE that is created has the Generic All type for CLUSTER$ and it matches what I am trying to do in PowerShell. I need to be able to update the ACL with the user account that has been delegated access to the OU with PowerShell.
Here is the error I am seeing when I try to do this with PowerShell.
System.UnauthorizedAccessException: Access is denied ---> System.ServiceModel.FaultException: The operation failed due to insufficient access rights. --- End of inner exception stack trace --- at Microsoft.ActiveDirectory.Management.AdwsConnection.ThrowExceptionForExtendedError(String extendedErrorMessage, Exception innerException) at Microsoft.ActiveDirectory.Management.AdwsConnection.ThrowExceptionForErrorCode(String message, String errorCode, String extendedErrorMessage, Exception innerException) at Microsoft.ActiveDirectory.Management.AdwsConnection.ThrowExceptionForFaultDetail(FaultDetail faultDetail, FaultException faultException) at Microsoft.ActiveDirectory.Management.AdwsConnection.ThrowException(AdwsFault adwsFault, FaultException faultException) at Microsoft.ActiveDirectory.Management.AdwsConnection.Modify(ADModifyRequest request) at Microsoft.ActiveDirectory.Management.ADWebServiceStoreAccess.Microsoft.ActiveDirectory. Management.IADSyncOperations.Modify(ADSessionHandle handle, ADModifyRequest request) at Microsoft.ActiveDirectory.Management.ADActiveObject.Update() at Microsoft.ActiveDirectory.Management.Provider.ADProvider.SetSecurityDescriptor(String path, ObjectSecurity securityDescriptor)