CODEWITHSUNDEEP
powershellactive-directorypowershell-4.0network-security-groups
FalconRider
FalconRider

Reputation: 75

PowerShell: How to add 1 user to multiple Active Directory Security Groups - Security tab of the security group with write permission

I am trying to add 1 ID to multiple security groups in Active Directory. The ID needs to be only added to the "Security Tab" of the Security Group and not added as a member.

I need to set "write" permission for this ID.

Is there anyways to do this in Power-Shell?

Security Tab

Upvotes: 1

Views: 1030

Answers (1)

Gabriel Luci
Gabriel Luci

Reputation: 40898

There are instructions here, although that gives a user full control of the group (including rights to delete), and has some other issues (like a hard-coded username).

I've modified that example for you to only give GenericWrite permissions, and to accept the username as a parameter. This also assumes the user, group, and computer you're running this on are all on the same domain:

function Set-GroupSecurity {
[CmdletBinding()]
param (
 [string] $GroupName,
 [string] $UserName
)
    $dom = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
    $root = $dom.GetDirectoryEntry()

    $search = [System.DirectoryServices.DirectorySearcher]$root
    $search.Filter = "(&(objectclass=group)(sAMAccountName=$GroupName))"
    $search.SizeLimit = 3000
    $result = $search.FindOne()

    $object = $result.GetDirectoryEntry()

    $sec = $object.ObjectSecurity

    ## set the rights and control type
    $allow = [System.Security.AccessControl.AccessControlType]::Allow
    $read = [System.DirectoryServices.ActiveDirectoryRights]::GenericRead
    $write = [System.DirectoryServices.ActiveDirectoryRights]::GenericWrite

    ## who does this apply to
    $domname = ([ADSI]"").Name
    $who = New-Object -TypeName System.Security.Principal.NTAccount -ArgumentList "$domname", $UserName

    # apply rules
    $readrule = New-Object -TypeName System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $who, $read, $allow
    $sec.AddAccessRule($readrule)

    $writerule = New-Object -TypeName System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $who, $write, $allow
    $sec.AddAccessRule($writerule)

    # tell it that we're only changing the DACL and not the owner
    $object.get_Options().SecurityMasks = [System.DirectoryServices.SecurityMasks]::Dacl

    # save
    $object.CommitChanges()
}

You can paste that into a PowerShell prompt and hit enter. That will make the function available to use. Then you can use it like this:

Set-GroupSecurity -GroupName "TstGroup1" -UserName "someone"

Upvotes: 1

Related Questions