I have an OU in AD called SQL. I have delegated full control of the OU to a user called sqladmin.
If I log in to a member server as sqladmin, I can use Active Directory Users and Computers to create two different computer objects, AG and Cluster. I can use ADUC to to set the security on AG computer object such that the Cluster computer object has full control.
However, if I try to do this with PowerShell by getting the current ACL off of AG and adding an ACE, I get an Access Denied error when I try to set the ACL on the AG Computer object.
Here is my code
$AG = Get-ADComputer AG
$cluster = Get-ADComputer cluster
$AGDistinguishedName = $AG.DistinguishedName # input AD computer distinguishedname
$AGacl = Get-Acl "AD:\$AGDistinguishedName"
$SID = [System.Security.Principal.SecurityIdentifier] $cluster.SID
$identity = [System.Security.Principal.IdentityReference] $SID
$adRights = [System.DirectoryServices.ActiveDirectoryRights] "GenericAll"
$type = [System.Security.AccessControl.AccessControlType] "Allow"
$inheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] "None"
$ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $identity,$adRights,$type,$inheritanceType
$AGacl.AddAccessRule($ace)
Set-Acl -path "AD:\$AGDistinguishedName" -AclObject $AGacl
However, If I log in as a domain admin and run the code, it works fine. The code only fails when I log in as the sqladmin user. However, I can perform the task with sqladmin using the GUI.
I can also confirm that if I use the GUI, the ACE that is created has the Generic All type for CLUSTER$ and it matches what I am trying to do in PowerShell. I need to be able to update the ACL with the user account that has been delegated access to the OU with PowerShell.
Here is the error I am seeing when I try to do this with PowerShell.
System.UnauthorizedAccessException: Access is denied --->
System.ServiceModel.FaultException: The operation failed due to insufficient access rights.
--- End of inner exception stack trace ---
at
Microsoft.ActiveDirectory.Management.AdwsConnection.ThrowExceptionForExtendedError(String
extendedErrorMessage, Exception innerException)
at Microsoft.ActiveDirectory.Management.AdwsConnection.ThrowExceptionForErrorCode(String
message, String errorCode, String extendedErrorMessage, Exception innerException)
at
Microsoft.ActiveDirectory.Management.AdwsConnection.ThrowExceptionForFaultDetail(FaultDetail
faultDetail, FaultException faultException)
at Microsoft.ActiveDirectory.Management.AdwsConnection.ThrowException(AdwsFault
adwsFault, FaultException faultException)
at Microsoft.ActiveDirectory.Management.AdwsConnection.Modify(ADModifyRequest request)
at Microsoft.ActiveDirectory.Management.ADWebServiceStoreAccess.Microsoft.ActiveDirectory.
Management.IADSyncOperations.Modify(ADSessionHandle handle, ADModifyRequest request)
at Microsoft.ActiveDirectory.Management.ADActiveObject.Update()
at Microsoft.ActiveDirectory.Management.Provider.ADProvider.SetSecurityDescriptor(String
path, ObjectSecurity securityDescriptor)