Active Directory – Adding Permissions to an Account Using PowerShell

active-directorypowershell

We're deploying Active Directory, and we're using PowerShell scripts for most of it: creating the forest, creating AD elements (users, groups, sites, subnets), etc. We'd like to make some users able to join machines to the domain, but I haven't found a way to do it with PowerShell. It seems there are no cmdlets for that. Is it so? Is it impossible to add this kind of permissions using only PowerShell?

Thanks in advance.

Best Answer

If you want a purely powershell method, you may use info from this technet blog post, or take a look at the Quest powershell cmdlets. http://blogs.technet.com/b/joec/archive/2013/04/25/active-directory-delegation-via-powershell.aspx

In my company we have several groups that need to create unlimited computer accounts. I continue to use the DSACLS.EXE tool, because I have past experience with it, and while it is cryptic I can accomplish in a few lines what take many many lines of pure powershell with either of the methods mentioned above. DSACLS has a long and very thorough help page. I've pared it down for brevity in this post to only address the perm to create computer accounts. With some research, you should also be able to find the object names and permission levels to create the other things you mention. Remember that Users & Groups would be covered by membership in "Account Operators" and you may want to restrict Site & Subnet creation to members of "Domain Admins"

Grant a group the right to create computer accounts at a given OU path. Replace ThisDom & ThisGroup to fit your environment. 

dsacls "OU=coyote,DC=acme,DC=com" /I:T /G 'ThisDom\ThisGroup:CCDC;computer'
dsacls "OU=coyote,DC=acme,DC=com" /I:S /G 'ThisDom\ThisGroup:WO;;computer'
dsacls "OU=coyote,DC=acme,DC=com" /I:S /G 'ThisDom\ThisGroup:WP;userAccountControl;computer'

Usage (edited)

C:\Windows\System32>dsacls /?
Displays or modifies permissions (ACLS) of an Active Directory Domain Services (AD DS) Object

DSACLS object [/I:TSP] [/N] [/P:YN] [/G <group/user>:<perms> [...]]
              [/R <group/user> [...]] [/D <group/user>:<perms> [...]]
              [/S] [/T] [/A] [/resetDefaultDACL] [/resetDefaultSACL]
              [/takeOwnership] [/user:<userName>] [/passwd:<passwd> | *]
              [/simple]
<... skipped lines...>
   /I               Inheritance flags:
                        T: This object and sub objects
                        S: Sub objects only
                        P: Propagate inheritable permissions one level only.
<... skipped lines...>
   /G  <group/user>:<perms>
                    Grant specified group (or user) specified permissions.
                    See below for format of <group/user> and <perms>
<... skipped lines...>
            CC      Create child object
            DC      Delete a child object
            WO      Change owner information
            WP      Write property
Related Topic