Hallo,
wir haben das Problem, dass bei vielen Benutzern der Haken für die Vererbung der übergeordneten Berechtigungen fehlt.
Ich habe ein VB-Script gefunden, dass bei jeden Benutzer den Haken setzt.
Das funktioniert auch erst einmal.
Jedoch ist der Haken am nächsten Tag wieder verschwunden.
Ich vermute, die Replikation anderer DCs überschreibt dies wieder.
Hier das Script das ich verwende:
Const SE_DACL_PROTECTED = &H1000
Dim objConnection, objCommand, objRootDSE
Dim strDNSDomain, strQuery
Dim objRecordSet
WScript.Echo "Script start"
Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("defaultNamingContext")
strQuery = "<LDAP://" & strDNSDomain & ">;(&(objectCategory=person)(objectClass=user)(sAMAccountName=*));distinguishedName;subtree"
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand = CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOOBject"
objConnection.Open "Active Directory Provider"
Set objCommand.ActiveConnection = objConnection
objCommand.CommandText = strQuery
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Timeout") = 300
objCommand.Properties("Cache Results") = False
Set objRecordSet = objCommand.Execute
objRecordSet.MoveFirst
Do Until objRecordSet.EOF
'WScript.Echo objRecordSet.Fields("distinguishedName").Value
SetACL(objRecordSet.Fields("distinguishedName").Value)
objRecordSet.MoveNext
Loop
objConnection.Close
Wscript.Echo "Script done"
WScript.Quit
Sub SetACL(strADsPath)
On Error Resume Next
Dim objADObject, objNtSecurityDescriptor, intNtSecurityDescriptorControl
Err.Clear
' Distinguished Name of user object hard coded.
Set objADObject = GetObject("LDAP://" & strADsPath)
' Retreive security descriptor object for this object.
Set objNtSecurityDescriptor = objADObject.Get("ntSecurityDescriptor")
' Retrieve control settings.
intNtSecurityDescriptorControl = objNtSecurityDescriptor.Control
If Err.Number <> 0 Then
WScript.Echo "Error: Failed to read ntSecurityDescriptor - " & strADsPath
Exit Sub
End If
If (intNtSecurityDescriptorControl And SE_DACL_PROTECTED) <> 0 Then
' Toggle the bit for "allow inheritable permissions".
intNtSecurityDescriptorControl = intNtSecurityDescriptorControl Xor SE_DACL_PROTECTED
' Save control settings in the security descriptor object.
objNtSecurityDescriptor.Control = intNtSecurityDescriptorControl
' Save the security descriptor object.
objADObject.Put "ntSecurityDescriptor", objNtSecurityDescriptor
' Update the user object.
objADObject.SetInfo
If Err.Number <> 0 Then
WScript.Echo "Error: Failed to set ntSecurityDescriptor - " & strADsPath
Else
WScript.Echo "OK: ntSecurityDescriptor has been changed - " & strADsPath
End If
Else
WScript.Echo "OK: ntSecurityDescriptor already fixed - " & strADsPath
End If
End Sub
Gibt es noch eine andere Möglichkeit den Haken zu setzen (natürlich nicht manuell)?
MVP Group Policy - Mythen, Insiderinfos und Troubleshooting zum Thema GPOs: http://matthiaswolf.blogspot.com/
