Экспортируйте в файл get-acl для объекта компьютера ad, а затем импортируйте позже с помощью set-acl.

All joking aside, Exchange has ravaged my AD DACLs. To the point Exchange isn’t even working right. I built a lab with an identical AD structure but fresh on 2022-OS/2019-EX-CU12 just so I can see what the correct permissions look like.

What I would rather do is this on the clean side:

$acl = get-acl -path "AD:DC=prod,DC=widgets,DC=corp"
$acl.Access | ? {$_.IdentityReference -like "*Exchange*" -or $_.IdentityReference -like "*Organization*"} | export-CliXml -Path c:\temp\ftw.xml

Then remove row records from the text file I don’t need to import, for those I do I would modify the domain name in the xml file to match the production side:

$CleanACLs = Import-Clixml C:\temp\ftw.xml
$TestVictom = "AD:CN=Poor User,OU=Employees,DC=prod,DC=myCompany,DC=corp"
$acl = get-acl -path $TestVictom
#Testing just one ACL
$NewACE = ($CleanACLs)[0]
$acl.AddAccessRule($newACE)
Set-Acl -Path $TestVictom -AclObject $acl

However, my dreams were busted by this error on the “$acl.AddAccessRule($newACE)” line:

MethodException: Cannot convert argument “rule”, with value: “System.DirectoryServices.ActiveDirectoryAccessRule”, for “AddAccessRule” to type “System.DirectoryServices.ActiveDirectoryAccessRule”: “Cannot convert the “System.DirectoryServices.ActiveDirectoryAccessRule” value of type “Deserialized.System.DirectoryServices.ActiveDirectoryAccessRule” to type “System.DirectoryServices.ActiveDirectoryAccessRule”.”

It seems something as silly as the fact the import-clixml changing ALL of the objects to add the deserialized. is the issue. I am fairly sure the objects are identical otherwise. Ironically, I was using clixml to preserve object type.

Anyone got any magic to get these objects to not have the prefix of deserialized?

Otherwise, anyone have a decent way to export an AD object DACL to an editable text file, with a way to re-import? The only thing I need to do in the text file is remove unneeded rows (which I can technically filter on the source side) as well change the domain name of the IdentityReference).

I can’t find a solution.
How can I use PowerShell to add a group to another group in the security tab?
Should I use ACL? If so, has anyone solved this problem and can guide me?
enter image description here

I try use this solve
Set ACL of multiple group in AD via POWERSHELL

:/> Комбинация клавиш для сна компьютера

I want to add group ‘Kat-VPN1’ to group ‘Kat-VPN3’ but on the security tab

I have code

cls
import-module ActiveDirectory$path = "AD:\CN=Kat-
VPN3,OU=Groups,OU=LOC_1,OU=OFFICE,DC=tm,DC=pl"
$acl = Get-Acl -Path $path
$ace = New-Object Security.AccessControl.ActiveDirectoryAccessRule('DOMAIN\Kat-VPN1','FullControl')
$acl.AddAccessRule($ace)
Set-Acl -Path $path -AclObject $acl

asked Nov 20, 2023 at 11:18

Tomasz Młynek's user avatar

I solved my problem.

# Importing Active Directory module
Import-Module ActiveDirectory
# Defining group names
$groupToAddName = "Kat-VPN1"
$targetGroupName = "Kat-VPN3"
try {
# Getting group objects
$groupToAdd = Get-ADGroup -Filter {Name -eq $groupToAddName}
$targetGroup = Get-ADGroup -Filter {Name -eq $targetGroupName}
# Getting ACL object for the target group
$acl = Get-Acl -Path "AD:\$($targetGroup.DistinguishedName)"
# Getting ACL object for the group to be added
$groupToAddSid = New-Object System.Security.Principal.SecurityIdentifier($groupToAdd.SID.Value)
# Checking if $groupToAddSid is not null
if ($groupToAddSid -ne $null) { $groupRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($groupToAddSid, "WriteProperty, ReadProperty, CreateChild, DeleteChild", "Allow") # Adding rule to ACL $acl.AddAccessRule($groupRule) # Setting updated ACL for the target group Set-Acl -Path "AD:\$($targetGroup.DistinguishedName)" -AclObject $acl Write-Host "The group $groupToAddName has been added with modify permissions to the ACL of group $targetGroupName."
} else { Write-Host "Error creating SecurityIdentifier. Check if the group $groupToAddName exists."
}
} catch {
Write-Host "An error occurred: $_"

answered Dec 14, 2023 at 14:04

Tomasz Młynek's user avatar

Windows Access Control Lists (ACLs) are an essential feature for managing permissions and security in the Windows operating system. They provide a detailed mechanism for defining who can access or modify objects, such as files, folders, and registry keys, and what actions they are allowed to perform on these objects. Here’s a detailed overview of Windows ACLs:

Components of Windows ACLs

- Files and Folders: Common objects that have ACLs.
- Registry Keys: Specific keys within the Windows Registry.
- Each object that can have permissions assigned to it has a security descriptor.
- The security descriptor contains the ACL.
Access Control Entries (ACEs):
- An ACL is made up of multiple ACEs.
- ACEs can be allow or deny entries.

:/> "Utilizing the cmd feature to handle date-related tasks and identifying the duration of system uptime without any need to shut down, taking inspiration from the functionality of a Windows Server 2008 R2 operating system."