Get/Set-ADACL (ACL and SDDLs for Active Directory!)
A friend had a need to get/set Active Directory ACLs. So I wrote these.
They will use [System.DirectoryServices.ActiveDirectoryAccessRule] objects or SDDLs strings.
Note: I put the .NET classes and MS Spec for SDDLs at the bottom. Dont miss it!
Get-ADACL.ps1
Param($DNPath,[switch]$SDDL,[switch]$help,[switch]$verbose)
function HelpMe{
Write-Host
Write-Host " Get-ADACL.ps1:" -fore Green
Write-Host " Gets ACL object or SDDL for AD Object"
Write-Host
Write-Host " Parameters:" -fore Green
Write-Host " -DNPath : Parameter: DN of Object"
Write-Host " -sddl : [SWITCH]: Output SDDL instead of ACL Object"
Write-Host " -Verbose : [SWITCH]: Enables Verbose Output"
Write-Host " -Help : [SWITCH]: Displays This"
Write-Host
Write-Host " Examples:" -fore Green
Write-Host " Get ACL for ‘cn=users,dc=corp,dc=lab’" -fore White
Write-Host " .\Get-ADACL.ps1 ‘cn=users,dc=corp,dc=lab’" -fore Yellow
Write-Host " Get SDDL for ‘cn=users,dc=corp,dc=lab’" -fore White
Write-Host " .\Get-ADACL.ps1 ‘cn=users,dc=corp,dc=lab’ -sddl " -fore Yellow
Write-Host
}
if(!$DNPath -or $help){HelpMe;return}
Write-Host
if($verbose){$verbosepreference="continue"}
Write-Verbose " + Processing Object [$DNPath]"
$DE = [ADSI]"LDAP://$DNPath"
Write-Verbose " – Getting ACL"
$acl = $DE.psbase.ObjectSecurity
if($SDDL)
{
Write-Verbose " – Returning SDDL"
$acl.GetSecurityDescriptorSddlForm([System.Security.AccessControl.AccessControlSections]::All)
}
else
{
Write-Verbose " – Returning ACL Object [System.DirectoryServices.ActiveDirectoryAccessRule]"
$acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier])
}
Set-ADACL.ps1
Param($DNPath,$acl,$sddl,[switch]$verbose,[switch]$help)
function HelpMe{
Write-Host
Write-Host " Set-ADACL.ps1:" -fore Green
Write-Host " Sets the AD Object ACL to ‘ACL Object’ or ‘SDDL’ String"
Write-Host
Write-Host " Parameters:" -fore Green
Write-Host " -DNPath : Parameter: DN of Object"
Write-Host " -ACL : Parameter: ACL Object"
Write-Host " -sddl : Parameter: SDDL String"
Write-Host " -Verbose : [SWITCH]: Enables Verbose Output"
Write-Host " -Help : [SWITCH]: Displays This"
Write-Host
Write-Host " Examples:" -fore Green
Write-Host " Set ACL on ‘cn=users,dc=corp,dc=lab’ using ACL Object" -fore White
Write-Host " .\Set-ADACL.ps1 ‘cn=users,dc=corp,dc=lab’ -ACL $acl" -fore Yellow
Write-Host " Set ACL on ‘cn=users,dc=corp,dc=lab’ using SDDL" -fore White
Write-Host " .\Set-ADACL.ps1 ‘cn=users,dc=corp,dc=lab’ -sddl `$mysddl" -fore Yellow
Write-Host
}
if(!$DNPath -or (!$acl -and !$sddl) -or $help){HelpMe;Return}
Write-Host
if($verbose){$verbosepreference="continue"}
Write-Verbose " + Processing Object [$DNPath]"
$DE = [ADSI]"LDAP://$DNPath"
if($sddl)
{
Write-Verbose " – Setting ACL using SDDL [$sddl]"
$DE.psbase.ObjectSecurity.SetSecurityDescriptorSddlForm($sddl)
}
else
{
foreach($ace in $acl)
{
Write-Verbose " – Adding Permission [$($ace.ActiveDirectoryRights)] to [$($ace.IdentityReference)]"
$DE.psbase.ObjectSecurity.SetAccessRule($ace)
}
}
$DE.psbase.commitchanges()
Write-Host
More Info
I used the following .NET Classes
System.DirectoryServices.DirectoryEntry
http://msdn2.microsoft.com/en-us/library/system.directoryservices.directoryentry.aspx
System.DirectoryServices.ActiveDirectoryAccessRule
http://msdn2.microsoft.com/en-us/library/system.directoryservices.activedirectoryaccessrule.aspx
System.DirectoryServices.ActiveDirectorySecurity
http://msdn2.microsoft.com/en-us/library/system.directoryservices.activedirectorysecurity.aspx
System.Security.AccessControl.AccessControlSections
http://msdn2.microsoft.com/en-us/library/system.security.accesscontrol.accesscontrolsections(vs.80).aspx
SDDL Info
MS: http://msdn2.microsoft.com/en-us/library/aa379567.aspx
tshell :: Mar.30.2008 :: .NET, Active Directory, HowTo, Powershell, Scripting :: 4 Comments »
4 Responses to “Get/Set-ADACL (ACL and SDDLs for Active Directory!)”
Leave a Reply
You must be logged in to post a comment.
I need to copy AD ACLS from 1 domain to another. All the objects have the same name but not the same SIDS. Is there a way to change just the domain name in either a $acl or $SDDL ? – Thanks!
Yves, I am certain this is possiable, but I am not sure how simple it would be. Unless you had the SID for user you couldn’t use the SDDL so you would have to modify the $acl directly.
Either way… this would take forever and a day to run if you have a large AD. When you say “all objects” do you just mean OU’s, Users, Computers?
Can i pipe the getacl into a setacl command for a different tree?
if so what would the syntax be?
Yes… it *should* act just like get/set-acl
Try this
get-adacl $DN | %{set-adacl -dn -acl $_}