Copy AD permissions list from one object to another RRS feed

  • Întrebare

  • I'm trying to copy a list of permissions that are not being inherited applied to an OU to a different OU, located in the same domain as the first one.

    >$perms=Get-ADPermission "ou=test,ou=global,dc=fabrikam,dc=com" | ? { -not $_.IsInherited }

    >$perms | % { Add-ADPermission "ou=test2,ou=global,dc=fabrikam,dc=com" -user $_.User -accessrights $_.AccessRights -properties $_.Properties -extendedRights $_.ExtendedRights }

    The following error is thrown for each permission entry:

    Active Directory operation failed on DC.fabrikam.com. This error is not retriable. Additional information: Access is denied.
    Active directory response: 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
        + CategoryInfo          : WriteError: (0:Int32) [Add-ADPermission], ADOperationException
        + FullyQualifiedErrorId : 8B2031D5,Microsoft.Exchange.Management.RecipientTasks.AddADPermission

    Now, this has been tackled before (http://social.technet.microsoft.com/Forums/en/exchange2010/thread/ff0f78c8-4518-4c3d-b67d-e1da10923bc9) but it's rather complicated to do for each object whose permission might need to be copied - maybe querying USNs, but I'm not seeing this going too far.

    Is there a way to copy the permissions in an automated fashion, using Powershell ?

    marți, 3 aprilie 2012 14:00


  • Have you checked this link? I know it's on a BB forum but it can be adapted.

    Maybe this will help.

    The PS cmd should be something like:

     Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User "Admin" -Identity "CN=Users,DC=example,DC=com"

    MCTS - Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. http://mariusene.wordpress.com/

    joi, 5 aprilie 2012 13:05